2018 Business Plan and Budget

Transcription

1 2018 Business Plan and Budget Draft 1 May 19, 2017 I

2 Table of Contents Table of Contents... ii About NERC... 1 Overview... 1 Membership and Governance... 2 Scope of Oversight... 2 Statutory and Regulatory Background... 3 Funding... 3 Introduction and Executive Summary... 5 Strategic Goals and Metrics... 6 Strategic Goals Key Business Planning Assumptions Section A 2018 Business Plan and Budget Program Area and Department Detail Reliability Standards Compliance Monitoring and Enforcement and Organization Registration and Certification Compliance Assurance Compliance Analysis, Organization Registration and Certification Compliance Enforcement Reliability Assessment and System Analysis Reliability Risk Management Situation Awareness Event Analysis Performance Analysis Electricity Information Sharing and Analysis Center (E-ISAC) Training, Education, and Personnel Certification Administrative Services General and Administrative Legal and Regulatory Information Technology Human Resources Finance and Accounting Section B Supplemental Financial Information Table B-1 Operating Reserve and Assessment Analysis Table B-2 Penalties Table B-3 Outside Funding Table B-4 Personnel Table B-5 Meetings Table B-6 Consultants and Contracts Table B-7 Rent ii

3 Table of Contents Table B-8 Office Costs Table B-9 Professional Services Table B-10 Miscellaneous Table B-11 Other Non-Operating Expenses Table B-12 Fixed Assets Table B Projections Section C Non-Statutory Activity Section D Supplemental Financial Statements Exhibit A Shared Assumptions and Key Focus Areas Exhibit B Application of NERC Section 215 Criteria Exhibit C Contractor and Consulting Costs Exhibit D Capital Financing Exhibit E Working Capital and Operating Reserve Amounts Exhibit F E-ISAC Long-Term Strategy Exhibit G Compliance Monitoring and Enforcement Technology Program iii

4 About NERC Overview The North American Electric Reliability Corporation (NERC) is a not-for-profit entity organized under the New Jersey Nonprofit Corporation Act. NERC s mission is to improve and ensure the reliability of the Bulk Power System (BPS) 1 in North America. NERC s area of responsibility spans the continental U.S. and portions of Canada and Mexico. Entities under NERC s jurisdiction are the users, owners, and operators of the BPS a system that serves the needs of over 340 million people, includes installed electricity production capacity of approximately 1,200 gigawatts, operates 475,000 miles of high-voltage transmission (100 kv and above), and is comprised of assets worth more than one trillion dollars. Electric Reliability Organization (ERO) The Federal Energy Regulatory Commission (FERC or Commission) certifies and has oversight of NERC as the electric reliability organization (ERO) within the U.S. to establish and enforce reliability standards for the U.S. portion of the BPS, pursuant to Section 215 of the Federal Power Act ( 215). As of June 18, 2007, FERC granted NERC the legal authority to enforce reliability standards with all U.S. users, owners, and operators of the BPS and made compliance with those standards mandatory and enforceable. Equivalent relationships have been sought and, for the most part, realized in Canada and Mexico. International Relations Prior to adoption of 215 in the U.S., the Canadian provinces of Ontario (in 2002) and New Brunswick (in 2004) adopted all NERC reliability standards that were approved by the NERC Board of Trustees (Board) as mandatory and enforceable within their respective jurisdictions through market rules. Reliability legislation is in place, or NERC has memoranda of understanding with, provincial authorities in Ontario, New Brunswick, Nova Scotia, Québec, Manitoba, Saskatchewan, British Columbia, and Alberta, and with the National Energy Board of Canada (NEB). NERC s standards are mandatory and enforceable in Ontario and New Brunswick as a matter of provincial law. Manitoba has adopted legislation, and standards are also mandatory. In addition, NERC has been designated as the electric reliability organization under Alberta s Transmission Regulation, and certain reliability standards have been approved in that jurisdiction; others are pending. NERC reliability standards are now mandatory in British Columbia and Nova Scotia. NERC and the Northeast Power Coordinating Council (NPCC) have been recognized as standards-setting bodies by the Régie de l énergie of Québec, and Québec has the framework in place for reliability standards to become mandatory. NEB has made reliability standards mandatory for international power lines between the U.S. and Canada. In Mexico, the Comisión Federal de Electricidad has signed the Western Electricity Coordinating Council s (WECC s) reliability management system agreement, which applies only to Baja California Norte. On March 8, 2017, NERC, the Comisión Reguladora de Energía (CRE), and the Centro Nacional de Control de Energía (CENACE) signed a memorandum of understanding (MOU), which outlines a framework for a cooperative relationship between NERC and Mexico to further enhance reliability of the North American bulk power system. The MOU recognizes the established and growing interconnections between the U.S. and Mexico and roles of each party in support of continued reliability. The agreement establishes a collaborative mechanism for identification, assessment, and prevention of reliability risks to strengthen grid security, resiliency, and reliability. As outlined in the memorandum, executives from NERC, CRE, and CENACE have formed a steering group to establish priorities and objectives for the technical support and collaboration envisioned in the MOU. The steering group will also address governance matters, resource requirements, and funding mechanisms. Technical working groups comprised of staff from the three 1 NERC s standards, compliance, and enforcement activities are focused on the Bulk Electric System (BES), which is comprised of certain BPS facilities. 1

5 About NERC organizations will be formed as needed to implement the collaboration. Further information will be provided in the next draft of NERC s 2018 Business Plan and Budget (BP&B). Membership and Governance An 11-member Board, comprised of 10 independent trustees and NERC s president and chief executive officer (CEO) serving as the management trustee, governs NERC. The Board has formed several committees to facilitate oversight of the organization in the areas of finance and audit, governance and human resources, compliance, standards oversight and technology, nominations and, most recently, enterprise-wide risk. Membership in NERC is open to any person or entity that has an interest in the reliability of the North American Bulk Electric System (BES). Membership is voluntary and affords participants the opportunity to engage in the governance of the organization through election to the Member Representatives Committee (MRC). 2 More than 600 entities and individuals are members of NERC. Scope of Oversight As the international, multijurisdictional ERO in North America, NERC is authorized to: Propose, support the development of, monitor compliance with, and enforce mandatory reliability and security standards for the North American BES, subject to regulatory oversight and approvals from FERC in the U.S. and applicable authorities in Canada; Conduct near-term and long-term reliability assessments of the North American BPS; Certify BPS operators as having and maintaining the necessary knowledge and skills to perform their reliability responsibilities; Maintain situational awareness of events and conditions that may threaten BPS reliability; Coordinate efforts to improve physical and cyber security for the BPS of North America; Conduct detailed analyses and investigations of system disturbances and unusual events as well as measure ongoing system trends to determine root causes, uncover lessons learned, and issue relevant findings as advisories, recommendations, guidelines, and essential actions to the industry to mitigate and control risks to reliability; and Identify and prioritize risks to reliability and use a broad toolkit to mitigate and control risks to reliability, including the potential need for new or modified reliability and security standards, improved compliance monitoring and enforcement methods, or other initiatives. Delegated Authorities In executing its responsibility, NERC delegates certain authorities to eight regional reliability entities (Regional Entities or the Regions) to perform aspects of the ERO functions described through delegation agreements. FERC has approved delegation agreements between NERC and the eight Regional Entities (Florida Reliability Coordinating Council (FRCC), Midwest Reliability Organization (MRO), Northeast Power Coordinating Council, Inc. (NPCC), ReliabilityFirst (RF), SERC Reliability Corporation (SERC), Southwest Power Pool Regional Entity (SPP RE), Texas Reliability Entity, Inc. (Texas RE), and the Western Electricity Coordinating Council (WECC)). These agreements describe the authorities delegated and responsibilities assigned to the Regional Entities in the U.S. to address, among other things: (1) developing regional 2 The Member Representatives Committee (MRC) comprises voting representatives elected from the 12 membership sectors. The MRC elects the independent trustees and, along with the Board, votes on amendments to the Bylaws. The MRC also provides policy advice and recommendations to the Board on behalf of stakeholders with respect to annual budgets, business plans, and other matters pertinent to the purpose and operation of the organization. 2

6 About NERC reliability standards, (2) monitoring compliance with and enforcement of mandatory reliability standards (both North American-wide and regional), (3) certifying registered entities and registering owners, operators, and users of the BES, (4) assessing reliability and analyzing performance, (5) training and education, (6) event analysis and reliability improvement, and (7) situation awareness and infrastructure security. NERC expects Regional Entities whose territories and geographic footprints extend into Canadian provinces and Mexico to perform equivalent functions in those jurisdictions. ERO Enterprise Operating Model The collective network of leadership, experience, judgment, skills, and technologies shared among NERC and the eight Regional Entities is referred to as the ERO Enterprise (the Enterprise). In 2014, a common operating model, Improving Coordinated Operations across the ERO Enterprise, 3 was developed to define how NERC and the Regional Entities achieve excellence in the oversight and execution of statutory functions by collaborating to mitigate reliability risks. The model also defines the division of the roles and responsibilities for NERC and the Regional Entities to efficiently and effectively execute services performed as the collective Enterprise. In 2015, implementation of this model progressed with oversight plans developed for Compliance Monitoring and Enforcement programs, as well as Registration, continuing into 2016 with Performance Analysis, Situational Awareness, and Events Analysis. Further, NERC and the Regional Entities deepened their coordination activities to identify, prioritize, and address risks to reliability. NERC has unique responsibilities within the ERO Enterprise to design the oversight of program areas, develop operational oversight and leadership, set qualifications and expectations for the performance of delegated activities, and assess, train, and give feedback to corresponding regional programs. NERC also reviews and provides input to the annual Regional Entity business plans and budgets, including but not limited to review of resource allocations, staffing capacity assessments, and program performance assessments. NERC input and review occurs before regional board approval. Similarly, the Regional Entities have a mirrored set of responsibilities that include being responsive to the design of the operational model, providing input into the overall development of each ERO program area, providing training and development to meet ERO qualifications, being receptive to feedback from the ERO, and making responsive adjustments. Regional Entities also have an obligation to meet professional standards of independence and objectivity and provide the best available expertise for addressing risks. With due recognition and awareness of the distinction between individual roles, responsibilities, and corporate status, NERC and the Regional Entities are continually refining their individual and collective operating and governance practices in support of an agreed-upon set of strategic goals and objectives that are designed to ensure the ERO fulfills its statutory obligations. Statutory and Regulatory Background NERC s authority as the ERO in the U.S. is based on Section 215 of the Federal Power Act, as added by the Energy Policy Act of 2005, 4 and the Commission s regulations and orders issued pursuant to Section 215. In Canada, NERC s authorities are established by the memoranda of understanding and regulations previously mentioned. Funding Section 215 of the Federal Power Act and the Commission s regulations specify procedures for NERC s funding in the U.S. NERC s annual business plan and budget is subject to Commission approval in the U.S. 3 Improving Coordinated Operations Across the ERO Enterprise 4 This was codified in section 215 of the Federal Power Act, 16 United States C. 824o. 3

7 About NERC Once approved, NERC s annual funding is provided through assessments to load-serving entities. These assessments are allocated on a net-energy-for-load (NEL) basis. Equivalent funding mechanisms are provided in Canada, subject to the specific laws and regulations of each province. The Regional Entities funding requirements are addressed separately in their respective business plans and budgets, which must be reviewed and approved by NERC and FERC in the U.S. Assessments for the Regional Entity budgets are included in the overall NERC assessments to load-serving entities. 4

8 Introduction and Executive Summary TOTAL RESOURCES (in whole dollars) Statutory FTEs Non-statutory FTEs - Total FTEs Statutory Expenses $ 69,295,297 Non-Statutory Expenses $ - Total Expenses $ 69,295,297 Statutory Inc (Dec) in Fixed Assets $ 2,081,701 Non-Statutory Inc (Dec) in Fixed Assets $ - Total Inc (Dec) in Fixed Assets $ 2,081,701 Statutory Funding of Reserves $ 53,143 Non-Statutory Funding of Reserves $ - Total Working Capital Requirement $ 53,143 Net Proceeds from Financing Activities $ (385,000) Total Statutory Funding Requirement $ 71,045,141 Total Non-Statutory Funding Requirement $ - Total Funding Requirement $ 71,045, Budget U.S. Canada Mexico TOTAL US CANADA MEXICO Statutory Funding Assessments $ 61,804,211 TBD TBD TBD Non-Statutory Fees $ - $ - $ - $ - NEL - TBD TBD TBD NEL% 0.00% TBD TBD TBD 5

9 Introduction and Executive Summary Strategic Goals and Metrics The ERO Enterprise strategic plan 5 and framework is informed by the following activities completed in 2016: (1) NERC s State of Reliability (SOR) Report, 6 (2) the Reliability Issues Steering Committee s (RISC s) ERO Reliability Risk Priorities Report, 7 which includes identified risk profiles, and (3) input from stakeholders, the NERC Board, and Regional Entity boards. In 2016, these inputs were used by ERO Enterprise leadership as follows: Review the Goals The ERO Enterprise considers whether the plan s goals, which reflect its view of its mission and key activities over the longer term, should be revised. Update the Contributing Activities to the ERO Enterprise Goals The ERO Enterprise makes necessary adjustments to the contributing activities in support of each goal, identifying focus areas over a rolling three year period. Update the Metrics The ERO Enterprise makes necessary changes to the metrics, which are intended to measure progress in supporting the goals. Specifically, the metrics measures of success, thresholds, and targets are evaluated and adjusted annually as necessary. Develop Annual Business Plans and Budgets (BP&Bs) Working collaboratively, NERC and each of the Regional Entities develop annual BP&Bs that reflect the resources necessary to support achievement of the goals and contributing activities set forth in the plan. Since the central focus of the strategic plan is to drive NERC and Regional Entity operating activities, the ERO Enterprise recommended earlier this year that the strategic plan being rebranded as the ERO operating plan and a separate initiative be undertaken to develop a longer term strategy for the ERO Enterprise to guide future updates to the ERO Enterprise operating plan. The ERO Enterprise also recommended and the RISC committee agreed that updates to the operating plan and RISC report be made in alternating years in order to provide additional time for consideration of updated RISC recommendations in the operating plan. There will be a transition period between 2017 and 2018 to accommodate this alternating year schedule and the development and integration of a long term strategy into the strategic planning process. An initial draft of the long-term strategy will be posted for comment in July and reviewed at the Members Representative Committee meeting in August A revised draft will be posted for comment in September and final draft presented for review and approval at the NERC board meeting in November Draft updates to the RISC report and recommendations will also be reviewed at the November MRC meeting and a final report and updated recommendations submitted to the NERC Board for acceptance in February While these updates will specifically inform the development of the NERC and Regional Entity 2019 BP&Bs, management will also be reviewing and taking into consideration any feedback that is received as part of the updates to the operating plan and RISC report and recommendations in connection with the finalization of the 2018 BP&B. Evolving Reliability Risks Over the past six years, NERC has transformed its activities towards being more risk-based, ensuring that the right activities are focused on the most pertinent risks to the reliable operation of the bulk power system. The RISC is an advisory committee to the Board, providing key insights, priorities, and high-level leadership for issues of strategic importance to BPS reliability. The 2016 RISC report presents the results of its continued work to define and prioritize risks and to offer recommendations to the Board to inform the development of NERC s risk strategy. The report recommendations are considered as the Strategic 5 ERO Enterprise Strategic Plan and Metrics NERC s State of Reliability Report 7 ERO Reliability Risk Priorities Report 6

10 Introduction and Executive Summary Plan, goals, and supporting activities are updated for the coming years. In 2016, the RISC recommended a high level of focus and priority in the following areas: Cybersecurity Vulnerabilities Cyber threats are becoming more sophisticated and increasing in number. Exploitation of cybersecurity vulnerabilities can potentially result in loss of control or damage to BPS-related voice communications, data, monitoring, protection and control systems, or tools. A cyber-attack can lead to equipment damage, degradation of reliable operations, and loss of load. Further, cybersecurity vulnerabilities can come from several sources, both internal and external, and in some instances the utility may have its cybersecurity fully tested. Changing Resource Mix The rapid rate at which fuel costs, subsidies, and federal, state, and provincial policies are affecting the resource mix are creating a new paradigm in which planners, balancing authorities, and system operators are reacting to resource additions and retirements. Further, the integration of new technologies and distributed energy resources are affecting the availability of operators to see and control resources within their area. BPS Planning BPS planning is a risk closely tied to the changing resource mix because planners currently lack the ability to update or create system models and scenarios of potential future states to identify system needs based on the dynamic nature of the system. This changing system makes it increasingly difficult to evaluate BPS stability, including inertia and frequency response, voltage support (adequate dynamic and static reactive compensation), and ramping constraints. Resource Adequacy Changes in the generation resource mix and new technologies are altering the operational characteristics of the grid and will challenge system planners and operators to maintain reliability in real time. Failure to take into account these changing characteristics and capabilities can lead to insufficient capacity and essential reliability services to meet customer demands. Strategic Goals The ERO Enterprise has five strategic goals, adopted by the NERC Board in November 2016, enabling the ERO Enterprise to successfully carry out its mission as further described in the Strategic Plan for each goal. A detailed description and activities that contribute to its success are provided below, followed by additional information about the allocation of NERC s resources toward achievement of each goal. The associated metrics in support of these goals have been approved for Updated strategic goals and associated metrics will be finalized later in 2017 for the 2018 year, with opportunities for stakeholder feedback prior to their approval. At this time, it is not anticipated that these updates will have a material impact on NERC s overall budget or resource allocation among operating areas for However, the updates may potentially affect priorities and workload within particular departments and will inform resource planning and allocation for the 2019 budget year. Goal 1 Risk-Responsive Reliability Standards Reliability Standards establish threshold requirements for assuring the BES is planned, operated, and maintained to minimize risks of cascading failures, avoid damage to major equipment, or limit interruptions of the BPS. Reliability Standards are clear, timely, effective in mitigating risks to reliability, and consider cost-effectiveness/impact. 8 See ERO Enterprise Strategic Plan and Metrics for details. 7

11 Contributing Activities Introduction and Executive Summary Develop, modify, and conduct periodic reviews of the Reliability Standards to assure they are clear and properly structured for existing and emerging risks. Develop and implement ERO Enterprise and stakeholder feedback loops to identify and address any gaps or ambiguities in Reliability Standards. Review the recommendations from the Essential Reliability Services Task Force to determine if the current body of NERC s planning Reliability Standards sufficiently addresses the need for essential reliability services. Evaluate options for assessing the cost effectiveness/impact of Reliability Standards. Address regulatory issues and orders (e.g., supply chain and critical infrastructure protection Reliability Standards) and technical analysis supporting geomagnetic disturbance requirements. Facilitate implementation of Reliability Standards by providing guidance or outreach for approved Reliability Standards. Goal 2 Objective and Risk-informed Compliance Monitoring, Enforcement, and Organization Certification and Registration The ERO Enterprise is a strong enforcement authority that is objective, fair, and promotes a culture of reliability excellence through risk-informed compliance monitoring, enforcement, certification, and registration. Contributing Activities Implement registration program improvements to ensure consistent technical basis for registration and deregistration of entities. Implement the certification program consistently across the ERO Enterprise. Develop and implement compliance oversight plans for registered entities focusing on relevant risks, including consideration of inherent risk assessments and internal control evaluations. Implement compliance monitoring and enforcement timely and transparently, using a consistent framework. Enhance and implement training for ERO Enterprise Compliance Monitoring and Enforcement Program (CMEP) staff. Provide guidance and outreach to registered entities, including the review of Implementation Guidance for endorsement. Reduce recidivism through rigorous assessment of registered entities plans to mitigate noncompliance. Evaluate the existing compliance, reporting, and analysis tracking system and other compliance tools to support risk-based activities that meet the needs of the CMEP. Goal 3 Identification and Mitigation of Significant Risks to Reliability The ERO Enterprise identifies the most significant risks to reliability, provides assurance for mitigating reliability risks, and promotes a culture of reliability excellence. The ERO Enterprise supports the Electricity Information Sharing and Analysis Center (E-ISAC), the Cybersecurity Risk Information Sharing Program 8

12 Introduction and Executive Summary (CRISP), reliability assessments, performance analysis, event analysis, situational awareness, and physical security and cybersecurity preparedness. Contributing Activities Develop guidelines and industry practices to maintain accurate system models that include the resources (synchronous and inverter based), load, and controllable devices providing essential reliability services. Develop advanced and probabilistic methods to evaluate resource adequacy. Gather additional phasor measurement unit datasets to advance analytics and modeling improvements. Analyze system performance, events, and relationships among data sources to identify risks and mitigation strategies, and provide recommendations and lessons learned. Expand the use, availability, and value of physical security and cybersecurity threat and vulnerability information sharing, including cross sector communications, and analytics. In collaboration with the Critical Infrastructure Protection Committee and industry stakeholders, develop a risk process to address the potential impacts of cyber and physical security threats and vulnerabilities. Conduct assessments of system resiliency and develop guidance for operations in a more secure state. Engage industry, forums, and technical committees in identifying and mitigating risks, including reducing misoperations, AC substation equipment failures, vegetation-related outages, and improving cold weather preparedness and human performance. Goal 4 Identification and Assessment of Emerging Risks to Reliability The ERO Enterprise identifies, evaluates, studies, and independently assesses emerging risks to reliability. Contributing Activities Enhance reliability assessments to reflect changing resource mix behavior, including distributed energy resources and essential reliability services, using probabilistic approaches that consider the variable and energy limited nature of the evolving resource mix. Educate policy makers, regulators, and the industry of reliability effects and interconnection requirements for the changing resource mix. Develop sufficiency/adequacy guidelines for essential reliability services, including considerations of reliability attributes under a more diverse resource mix and changing load behavior, such as ramping, reserve services, and voltage support. Assess risks associated with cross sector dependencies and single points of disruptions. Develop, acquire, and maintain necessary tools for efficient data collection, management, and analytics across the ERO Enterprise. Evaluate the reliability impacts of distributed energy resources on planning, operations, and restoration and recovery, including the identification of data and information sharing needs. 9

13 Introduction and Executive Summary Goal 5 Effective and Efficient ERO Enterprise Operations The ERO Enterprise supports and encourages transparency, consistency, quality, efficiency, and timeliness of results and operates as a collaborative enterprise. Contributing Activities Articulate a shared vision of reliability excellence and support and inspire stakeholders continentwide in working to attain that vision. Acquire, engage, develop, and retain highly qualified talent with requisite technical expertise to execute the ERO Enterprise s statutory functions. Understand and manage ERO Enterprise internal risks. Enhance and implement documented oversight plans for Regional Entity delegated functions. Expand the efficiency and productivity of the ERO Enterprise through a disciplined approach to IT investments. Continue to efficiently and effectively manage resources within the ERO Enterprise. Quantitatively measure stakeholder satisfaction. Allocation of NERC Resources to Strategic Goals and Risk Priorities The charts below provide an overview of the allocation of both NERC and the ERO Enterprise s 2018 resources associated with each strategic goal and the related contributing activities discussed above. Using surveys, funding sources, and FTEs as a guide, the charts reflect the relative amount of total resources (people and dollars) focused on supporting each of the five strategic goals noted above. Obviously many departments work on multiple activities that further multiple goals, and precision in forecasting all activities supporting each goal is not feasible. However, these charts provide a general picture regarding how resources are allocated. 10

14 Introduction and Executive Summary Ongoing Focus on Cost Control and Efficiency NERC and the Regional Entities continue to work collaboratively to improve efficiency, evaluate resources, and leverage combined skillsets to improve various ERO Enterprise activities and control costs. This collaboration and the resulting efficiencies can be found in a number of areas, including but not limited to: ERO Enterprise IT Investments: NERC and the Regional Entities, working collaboratively under the oversight of NERC s Standards Oversight and Technology Committee (SOTC), have developed a long-term enterprise information technology program resulting in a number of enterprise tools. The goal is to enhance operations, improve efficiency and reduce costs at the NERC, regional and registered entity level. For example, enterprise tools have helped and will further facilitate efficiency of registration and data submittals, improved consistency in registered entity resources devoted to compliance, and improved overall reliability through information sharing on Events Analysis, protection system misoperations and Situational Awareness. Enforcement: NERC has worked closely with Regional Entities to streamline enforcement staff in connection with the development of more efficient and risk-based enforcement mechanisms. Standards: As standards development has matured, NERC management has reallocated Standards staff towards more critical activities like cyber security and analytical capabilities. Legal: As a result of the aforementioned efficiencies and the maturity of NERC s and ERO Enterprise s business processes, the legal department has reduced its resource requirements, reallocating limited resources to more critical priorities without increasing the company s overall staffing requirements. Forums: As further described in the quarterly forum reports to the NERC Board, NERC and the Regional Entities continue to leverage the transmission and generation forums to jointly address risks to reliability to mitigate their impacts on the reliable operation of the BES. 11

15 Introduction and Executive Summary Industry: The ERO Enterprise continues to collaborate with and rely on industry resources and expertise through the various standing committees, working groups, and task forces that are critical to both identifying and supporting key initiatives and priorities Key Business Planning Assumptions As part of the annual business planning process, NERC and the Regional Entities developed a set of shared business planning assumptions supporting the development their respective business plans and budgets. The Regional Entities used these assumptions to evaluate their projected workloads and determine resource levels and allocation required to complete necessary tasks and meet the obligations of their Regional Delegation Agreements. These common business planning assumptions are set forth in Exhibit A Shared Assumptions and Key Focus Areas. Application of Section 215 Criteria In its order approving NERC s 2013 Business Plan and Budget, FERC required NERC to establish criteria for determining whether its proposed activities are eligible for funding under Section 215. In an order dated April 19, 2013, FERC approved NERC s proposed criteria, with certain modifications. 9 Exhibit B Application of NERC Section 215 Criteria summarizes the major activities NERC proposes to undertake in 2018 and the approved Section 215 criteria applicable to such activities. Overview of 2018 Budget and Funding Requirements NERC s 2018 combined expense and fixed asset (capital) budget is approximately $71.4M, which represents an increase of approximately $1.8M (2.5%) from the 2017 budget. Total expenses are increasing approximately $2.4M (3.5%) over The total fixed asset (capital) budget, excluding depreciation, 10 is approximately $3.7M, a decrease of $696k from Approximately $8.4M (11.7%) of NERC s 2018 budget is related to CRISP. As further explained in Section A Electricity Information Sharing and Analysis Center (E-ISAC), the majority of the NERC CRISP budget will be funded by participating utilities, with a small portion funded through assessments. NERC s proposed 2018 assessment is approximately $61.8M, which represents an increase of $1.9M (3.3%) from 2017 and does not contain a proposed release of funds from the Assessment Stabilization Reserve to reduce 2018 assessments. The balance in the Assessment Stabilization Reserve includes $500k of penalty collections during the 12 months ended June 30, 2017, which NERC proposes to deposit in the Assessment Stabilization Reserve. One of the differences between NERC s current 2018 budget increase of 2.5% and the 3.3% 2018 assessment increase results from not releasing any funds from the Assessment Stabilization Reserve. NERC proposes the penalty funds deposited in the Assessment Stabilization Reserve be held to reduce assessments in one or more future periods. This loss of penalty offsets will not impact Canadian or Mexican assessments since U.S. penalty funds are only used to reduce U.S. assessments. 11 Other factors contributing to the difference between the proposed assessment increase and the unadjusted assessment increase include debt assumptions and projected reserve requirements, all of which impact assessments in Canada, Mexico, and the U.S. As a long-term strategy to stabilize assessments and align budget and assessment increases more closely, NERC has undertaken a multi-year strategy to manage assessment increases. NERC s policy Accounting, Financial Statement and Budgetary Treatment of Penalties Imposed and Received for Violations of 9 North American Electric Reliability Corporation, Order on Compliance 143 FERC 61,052 (2013). 10 NERC and the Regional Entities budget Depreciation as an Operating Expense with an equal and offsetting credit against budgeted Fixed Asset (capital) additions. As a result, the budgets do not include depreciation in the funding requirements. 11 Accounting, Financial Statement and Budgetary Treatment of Penalties Imposed and Received for Violations of Reliability Standards, December 8, 2008 and as amended August 15,

16 Introduction and Executive Summary Reliability Standards and NERC Rule of Procedure (ROP) specifies that penalties received during the period July 1 through the following June 30 are to be used in the subsequent budget period to offset U.S. assessment billings. However, ROP provides for exceptions or alternatives to this treatment if approved by the Commission. In February 2015, NERC s Board approved an amendment to the company s Working Capital and Operating Reserve Policy. 12 Among the approved changes to this policy was the creation of an Assessment Stabilization Reserve. 13 This reserve was established to address the strategic goal of more closely aligning annual budget and U.S. assessment increases and to provide resources to better manage year-to-year assessment increases. The eventual goal is to narrow the gap between annual percentage changes in NERC s budget and annual changes in assessments that results from year-to-year variations in penalty collections. NERC proposes to deposit the $500k of Penalties collected during the period July 1, 2016 June 30, 2017, in the Assessment Stabilization Reserve and (2) to not release any funds from the Assessment Stabilization Reserve to reduce 2018 assessments. As a result, NERC proposes an overall average 2018 assessment increase of 3.3%. The allocation of assessments to Canadian entities will depend on the final determination and allocation of certain compliance and enforcement costs to Canadian entities pursuant to NERC s policy on the allocation of compliance costs. 14 The following table provides a high-level year-over-year comparison of the major categories of expenses, total budget, and FTEs. 12 NERC s Working Capital and Operating Reserve Policy. ERC filed a petition with FERC on March 6, 2015 for approval of this policy; the Commission conditionally approved the revised policy in an order issued June 18, 2015, in Docket No. RR North American Electric Reliability Corporation, Order Conditionally Accepting Revisions to Working Capital and Operating Reserve Policy, 151 FERC 61,225 (2015). On August 14, 2015, NERC submitted a compliance filing to the June 18, 2015 order with a modification to the policy, which the Commission accepted by letter order dated September 18, 2015 (Docket No. RR ). 13 In accordance with the approved Working Capital and Operating Reserve Policy, this reserve may be funded with penalty funds and surplus operating reserves. The actual amount of the contribution, as well as releases from the fund to reduce assessments, is determined annually as part of NERC s business plan and budget process, based on recommendation by the Board s Finance and Audit Committee and requiring both Board and FERC approval. 14 Expanded Policy on Allocation of Certain Compliance and Enforcement Costs, July 29,

17 Introduction and Executive Summary Statement of Activities and Fixed Assets Expenditures 2017 and 2018 Budgets STATUTORY 2017 Budget Funding ERO Funding NERC Assessments 59,856, Projection Variance 2017 Projection v 2017 Budget Over(Under) 2018 Budget Variance 2018 Budget v 2017 Budget Over(Under) $ $ 59,856,314 $ 0 $ 61,804,211 $ 1,947, % Assessment Stabilization Reserve - Penalties 1,100,000 1,100, (1,100,000) Third-Party Funding (CRISP) 6,990,447 6,990, ,144, ,984 Testing Fees 1,921,900 1,921, ,790,000 (131,900) Services & Software 50,000 50, ,000 0 Workshops 230, ,300 75, ,000 (45,000) Interest 3,000 72,113 69,113 71,500 68,500 Miscellaneous Total Funding $ 70,151,660 $ 70,296,074 $ 144,413 $ 71,045,141 $ 893, % Expenses Personnel Expenses $ 38,641,331 $ 38,701,038 $ 59,707 $ 39,932,918 $ 1,291, % Meeting Expenses 3,372,886 3,753, ,763 3,395,100 22, % Operating Expenses 24,800,690 25,792, ,910 25,852,280 1,051, % Other Non-Operating 106, ,725 (0) 115,000 8, % Total Expenses $ 66,921,632 $ 68,354,012 $ 1,432,380 $ 69,295,297 $ 2,373, % Fixed Assets Depreciation $ (1,691,457) $ (1,781,346) $ (89,889) $ (1,594,299) $ 97,158 Computer & Software CapEx 2,572,000 2,446,669 (125,331) 2,501,000 (71,000) Equipment CapEx 1,800,000 1,085,477 (714,523) 1,175,000 (625,000) Inc(Dec) in Fixed Assets $ 2,680,543 $ 1,750,800 $ (929,743) $ 2,081,701 $ (598,842) -22.3% Total Budget $ 69,602,175 $ 70,104,812 $ 502,637 $ 71,376,999 $ 1,774, % FTEs % % Inc (Dec) NERC s 2018 budget and funding requirements reflect the resources necessary to support achievement of the goals and objectives set forth in the Strategic Plan. The 2018 budget is comprised of both operating and fixed asset (capital) costs. Operating costs generally include personnel, consulting, office space, software licensing, third-party data management, and communications and other customary services to support office operations. Fixed asset (capital) costs primarily reflect investments in equipment and software to support operations, including investments in the development of software applications and infrastructure to facilitate improved business processes and efficiency. Key Budget Assumptions Key assumptions used in the development of NERC s 2018 budget include the following: Increase of 3.76 full time equivalents (FTE) to provide additional support to the E-ISAC. These FTE additions will address critical analytical needs in the near term, and take the initial step toward staffing needs for the E-ISAC and CRISP as outlined in Exhibit F E-ISAC Long-Term Strategy. Management routinely reviews resource allocations to ensure that the appropriate amount and type of resources are being dedicated to key priorities and activities. As operations in some areas become more efficient and/or major initiatives are completed, resources are redeployed to priority areas. Applying a 6.0% reduction to FTEs (vacancy rate), which is the same as 2017, to account for attrition and hiring delays. This assumption is based on a review and analysis of historic attrition and vacancy rates, as well as the time it takes to recruit and onboard new staff. Market-based compensation for personnel. Executive and staff compensation and benefits are established based on guidelines established by NERC s Corporate Governance and Human Resources Committee (CGHRC) and comprehensive market compensation and benefit 14

18 Introduction and Executive Summary information provided by a leading nationally recognized compensation and benefits consulting firm, as well as other available data. An updated market study was completed in late 2015 under the oversight of NERC s CGHRC. Anticipating market increases in medical and dental benefit plan costs. Medical and dental premium cost estimates are based on market data provided by the company s benefits consultant. Current 2018 budget estimates are in the upper end of the range provided by NERC s benefits consultant. This estimate will continue to be evaluated prior to finalization of the recommended 2018 budget. No other changes to retirement or other benefit plans have been assumed for Meeting and travel expenses are being held flat based on a review of 2016 and 2017 costs. The company has undertaken a number of significant efforts over the past several years to reduce travel and meeting expenses. For example, the company has worked closely with Regional Entities to share meeting space where possible, which has helped reduce meeting costs. Contract and consulting expenses are developed on a department-by-department basis and reflect both known and anticipated expenses, based on historical and current information. Expenses for the 2018 budget increased $551k, primarily due to E-ISAC portal support and maintenance needs, as well the CRISP security review for which better cost information is known for the 2018 budget. Additional information on contract and consulting expenses can be found in Exhibit C Contractor and Consulting Costs. Fixed Asset (Capital) Budget and Capital Financing NERC s 2018 capital budget is approximately $3.7M (excluding depreciation), which represents a decrease of $696k from This decrease is primarily the result of leasing audio visual and certain computer equipment, resulting in a reduction of Fixed Assets and an increase in Office Costs in the 2018 budget. The table below provides a summary of the major capital budget components. NERC Capital Budget Budget 2017 Budget 2018 Variance 2018 Budget v 2017 Budget Variance % ERO Application Development $ 700,000 $ 2,100,000 $ 1,400, % E-ISAC Portal Improvement 1,000,000 - (1,000,000) % Document Management Program 335,000 - (335,000) % Hardware (storage, servers) 991, ,000 (186,000) -18.8% Other Equipment 885, ,000 (515,000) -58.2% Disaster Recovery 150, ,000 (50,000) -33.3% NERC Software Licenses 311, ,000 (10,000) % Total $ 4,372,000 $ 3,676,000 $ (696,000) -15.9% NERC has budgeted $3.4M (both operating expenses and capital expenditures) in 2018 for services related to the planning, design, and implementation of software applications supporting the development of enterprise tools for common NERC and Regional Entity operations. These ERO Enterprise related costs include $2.1M in capital expenditures and $1.3M in other IT operating costs. Additional information regarding the ERO Enterprise IT strategy, the current status of the development of ERO Enterprise IT applications, and projects that will be under development in 2018 can be found in Section A Information 15

19 Introduction and Executive Summary Technology. NERC s 2018 capital budget also includes ongoing funding for IT security, disaster recovery, data storage, replacement of servers and laptops, and software license costs. Compliance Monitoring and Enforcement Program (CMEP) Technology Project The aforementioned $2.1M in fixed asset (capital) expenditures for 2018 relates to a new entity registration tool ($600k) and a new CMEP tool ($1.5M). The IT department is working closely with the Regional Entities in 2017 and through the budget cycles to evaluate and implement strategic investments in tools that replace the current three applications with a single, common CMEP application. Items under consideration at this time include how Reliability Standards data is stored and maintained, as well as how best to support the various parts of the compliance and enforcement process (e.g., analysis of risk, development of implementation plans and audit schedules, actual compliance monitoring, and enforcement processing). The CMEP tool is expected to be approximately $5-6M in total, with work spanning from 2017 thru Funding for this work will be subject to review and approval as part of the business plan and budget process each year. Investments are being made in 2017 to evaluate and scope the long-term project, with a final determination on the project scope expected later in If the 2018 business plan and budget is approved with the recommended funding, but the project does not go forward, the related funding will be held in the Operating Contingency Reserve. For additional information on the CMEP technology program, please see Exhibit G Compliance Monitoring and Enforcement Technology Program. The 2018 budget projection assumes that approximately $2.1M of the total $3.7M capital budget will be financed through the capital financing program that was described and put in place as part of NERC s 2014 Business Plan and Budget. Further information regarding capital financing can be found in Exhibit D Capital Financing. Working Capital and Operating Reserves Management is proposing an overall reserve budget of $8.8M for Working Capital, the four categories of Operating Reserves, and the Assessment Stabilization Reserve under the company s Working Capital and Operating Reserve Policy. This represents an increase of $1.1M (13.9%) from the total reserve amounts included in NERC s 2017 budget. The working capital and reserve balances are broken down in the following manner: Working Capital: Represents the amount of funds necessary to satisfy the company s projected cash flow needs during the budget year, taking into account the projected timing of the receipt of funding and timing of capital and operating expenses. While individual categories reflect increases and decreases resulting from operating needs and uses, the 2018 budget does not reflect additional working capital requirements in total. Future Obligation Reserve: Includes funding that has been received to satisfy future obligations under lease, credit, loan, or other agreements to which the company is a party. This reserve is primarily comprised of existing funds and is budgeted to be $2.0M for System Operator Certification Reserve: Includes surplus funding from operator certification and testing fees that are above incurred expenses and shall be used solely to support operator testing and certification needs. The 2018 System Operator Certification Reserve is budgeted at $1.1M and comprised of existing funds. CRISP Reserve: Represents funds dedicated to support CRISP. These reserves are established pursuant to a CRISP budget agreed to and funded entirely by utilities participating in CRISP. These reserves have no impact on assessments and they are segregated from other reserves pursuant to the terms of the CRISP agreements. The CRISP reserves are projected to be $500k in the 2018 budget. 16

20 Introduction and Executive Summary Operating Contingency Reserve: Includes funds for contingencies that were not anticipated, assumed to be likely or the timing of which was uncertain, at the time of preparation and approval of the company s business plan and budget. NERC s current policy on Operating Contingency Reserves requires a reserve target of %, except as otherwise approved by the Board after review and recommendation by the NERC Finance and Audit Committee. This percentage is calculated against NERC s total budget for operating and capital expenditures, less those costs related to CRISP and System Operator Certification, each of which has a separate reserve category. For the 2018 budget, management is recommending an Operating Contingency Reserve of approximately $2.6M, or 4.2% of total budgeted operating and fixed asset (capital) costs. Assessment Stabilization Reserve: To date, this reserve has been funded entirely by previously received penalties and is projected to have a balance of $2.2M as of January 1, 2018, including the proposed deposit of $500k of Penalties received during the period July 1, 2016 June 30, 2017 (subject to requisite approvals). For purposes of the company s 2018 BP&B, management currently does not propose the release of any Assessment Stabilization Reserve funds to offset U.S. assessments. The balance of $2.2M in the Assessment Stabilization Reserve will be used to reduce U.S. assessments in one or more future periods, subject to review and approval by the NERC Board and the Commission in the applicable year s business plan and budget. Department Budget and FTE Comparisons The following table sets forth a total budget comparison by department. The amounts shown below reflect all direct and indirect departmental costs, including fixed asset (capital) costs. Costs incurred for general and administrative and other overheads are considered indirect, and are allocated to the statutory departments based on the ratio of that department s budgeted FTEs to total budgeted FTEs Total Budget by Department Total Budget 2017 Budget 2018 Budget Change 2018 Budget v 2017 Budget % Change Reliability Standards $ 8,100,282 $ 7,417,626 $ (682,656) -8.4% Compliance Monitoring and Enforcement Programs* 17,305,535 20,469,789 3,164, % Reliability Assessments and System Analysis 7,535,594 7,433,777 (101,817) -1.4% Reliability Risk Management 14,387,923 13,948,999 (438,924) -3.1% Training, Education, and Personnel Certification 3,757,501 3,109,974 (647,526) -17.2% NERC Budget, excluding E-ISAC $ 51,086,835 $ 52,380,166 $ 1,293, % E-ISAC (non-crisp) $ 10,222,901 $ 10,636,565 $ 413, % E-ISAC (CRISP) 8,292,440 8,360,268 67, % Total E-ISAC Budget $ 18,515,341 $ 18,996,833 $ 481, % Total Budget $ 69,602,175 $ 71,376,999 $ 1,774, % *Includes Entity Registration and CMEP Tool Development The decrease in the Reliability Standards, and Training, Education, and Personnel departments is largely the result of the transfer of personnel resources from these departments as part of the ongoing process of internal reorganization to better align resources to support strategic goals and risk priorities, which results in lower indirect costs and allocation of fixed assets to these departments. Similarly, while Reliability Risk Management did not have a decrease in personnel resources, the group received less indirect costs and allocation of fixed assets because of the increase of personnel in other areas. The increase in the Compliance Monitoring and Enforcement departments costs are primarily due to the 17

21 Introduction and Executive Summary transfer of resources, including previously budgeted and open positions and related costs, to these departments from the departments noted above, as well as the costs associated with development of the CMEP and Entity Registration applications, as further discussed below in Section A Information Technology. The increase in E-ISAC department costs are largely related to the additional FTEs planned for this department. The following table presents a 2018 versus 2017 comparison of budgeted FTEs by department and reflects 2017 personnel additions, interdepartmental transfers of previously budgeted positions, and attrition assumptions. The number of FTEs represents the number of employees employed full time during the year, plus the number of employees employed part time (less than full schedule), or during a portion of the year converted to a full-time basis. Headcount represents the total number of personnel employed during the year, regardless of the length of their employment during that year. FTEs will be less than headcount, unless there are no part-time employees or employees who are employed less than a full year. The company s 2018 personnel budget is based upon existing headcount and associated compensation and benefit costs, as well as assumptions on the number and cost of new hires and the assumed vacancy rate, all within an overall FTE budget. An average vacancy rate is applied to each position and its associated costs to arrive at an overall personnel cost budget. The vacancy rate represents an adjustment, which is applied in the calculation of budgeted personnel costs to account for attrition and for variations from the budget assumptions on the timing of new hires Year-Over-Year Comparison of FTEs by Department FTEs* 2017 Budget 2018 Budget Change 2018 Budget v 2017 Budget % Change Reliability Standards (0.71) -4.1% Compliance Monitoring and Enforcement Programs % Reliability Assessments and System Analysis % Reliability Risk Management % Training, Education, and Personnel Certification (1.17) -16.6% Administrative Programs (1.88) -2.7% NERC FTEs, excluding E-ISAC (0.00) 0.0% E-ISAC (non-crisp) % E-ISAC (CRISP) % Total E-ISAC FTEs % Total FTEs % * Reflects 2018 additions and transfers between departments, anticipated timing of 2018 hires, and assumes 6% attrition in all programs Total FTEs in the Reliability Standards, Training, Education, and Personnel Certification, and Administrative programs is decreasing by 3.76 FTEs (4.0%), reflecting the reallocation of previously budgeted and pen positions to the Compliance Assurance and Compliance Analysis, Organization Certification and Registration departments. The increase in E-ISAC department FTEs addresses immediate analytical 18

22 Introduction and Executive Summary capability needs and represents a first step in the possible expansion of the E-ISAC as further outlined in Exhibit F E-ISAC Long-Term Strategy. The NERC 2018 organizational chart can be found in Appendix 1. The difference between the number of positions reflected in the 2018 organizational chart and total 2018 budgeted FTEs is due to assumptions regarding vacancy rates and timing of new hires. The 2018 organizational chart in Appendix 1 does not include the additional positions discussed in Exhibit F E-ISAC Long-Term Strategy. The following table includes a statement of activities comparing the 2017 budget and the 2018 budgets. 19

23 Introduction and Executive Summary Statement of Activities and Fixed Assets Expenditures 2017 and 2018 Budgets STATUTORY 2017 Budget Funding ERO Funding NERC Assessments 59,856, Projection Variance 2017 Projection v 2017 Budget Over(Under) 2018 Budget Variance 2018 Budget v 2017 Budget Over(Under) $ $ 59,856,314 $ 0 $ 61,804,211 $ 1,947, % Assessment Stabilization Reserve - Penalties 1,100,000 1,100, (1,100,000) Total NERC Funding $ 60,956,314 $ 60,956,314 $ 0 $ 61,804,211 $ 847,897 Third-Party Funding (CRISP) $ 6,990,447 $ 6,990,447 $ 0 $ 7,144,431 $ 153,984 Testing Fees 1,921,900 1,921, ,790,000 (131,900) Services & Software 50,000 50, ,000 0 Workshops 230, ,300 75, ,000 (45,000) Interest 3,000 72,113 69,113 71,500 68,500 Miscellaneous Total Funding (A) $ 70,151,660 $ 70,296,074 $ 144,413 $ 71,045,141 $ 893, % Expenses Personnel Expenses Salaries $ 30,073,438 $ 30,202,897 $ 129,459 $ 31,020,351 $ 946,913 Payroll Taxes 1,847,130 1,843,079 (4,052) 1,891,214 44,084 Benefits 3,643,806 3,635,671 (8,135) 3,873, ,230 Retirement Costs 3,076,956 3,019,391 (57,565) 3,148,316 71,360 Total Personnel Expenses $ 38,641,331 $ 38,701,038 $ 59,707 $ 39,932,918 $ 1,291, % Meeting Expenses Meetings $ 1,071,500 $ 1,176,500 $ 105,000 $ 1,071,500 $ (0) Travel 2,203,786 2,258,784 54,998 2,204, Conference Calls 97, , , ,600 22,000 Total Meeting Expenses $ 3,372,886 $ 3,753,649 $ 380,763 $ 3,395,100 $ 22, % Operating Expenses Consultants & Contracts $ 13,127,749 $ 13,751,419 $ 623,670 $ 13,679,185 $ 551,437 Office Rent 3,117,009 3,117, ,091,804 (25,205) Office Costs 4,359,340 4,631, ,600 4,978, ,744 Professional Services 2,468,135 2,468, ,469,408 1,273 Miscellaneous 37,000 42,750 5,750 39,500 2,500 Depreciation 1,691,457 1,781,346 89,889 1,594,299 (97,158) Total Operating Expenses $ 24,800,690 $ 25,792,600 $ 991,910 $ 25,852,280 $ 1,051, % Total Direct Expenses $ 66,814,907 $ 68,247,287 $ 1,432,380 $ 69,180,297 $ 2,365, % Indirect Expenses $ 0 $ (0) $ (0) $ 0 $ 0 Other Non-Operating Expenses $ 106,725 $ 106,725 $ (0) $ 115,000 $ 8, % Total Expenses (B) $ 66,921,632 $ 68,354,012 $ 1,432,380 $ 69,295,297 $ 2,373, % Change in Assets $ 3,230,028 $ 1,942,062 $ (1,287,966) $ 1,749,844 $ (1,480,184) Fixed Assets Depreciation $ (1,691,457) $ (1,781,346) $ (89,889) $ (1,594,299) $ 97,158 Computer & Software CapEx 2,572,000 2,446,669 (125,331) 2,501,000 (71,000) Furniture & Fixtures CapEx Equipment CapEx 1,800,000 1,085,477 (714,523) 1,175,000 (625,000) Leasehold Improvements Allocation of Fixed Assets 0 0 (0) 0 0 Inc(Dec) in Fixed Assets (C) $ 2,680,543 $ 1,750,800 $ (929,743) $ 2,081,701 $ (598,842) -22.3% TOTAL BUDGET (=B+C) $ 69,602,175 $ 70,104,812 $ 502,637 $ 71,376,999 $ 1,774, % TOTAL CHANGE IN WORKING CAPITAL (=A-B-C) 1 $ 549,485 $ 191,262 $ (358,223) $ (331,857) $ (978,501) % Inc (Dec) FTEs % 1 The budgeted change in working capital reflects both a reduction in excess working capital and operating reserves and the assumptions related to capital financing. Refer to Table B-1 for a complete analysis of the Working Capital and Operating Reserve balance. 20

24 Introduction and Executive Summary FERC Order 830 Geomagnetic Disturbance In FERC s Order No. 830 approving Reliability Standard TPL (Transmission System Planned Performance for Geomagnetic Disturbance Events), 15 FERC directed NERC to file a research work plan describing how NERC will conduct research into the specific geomagnetic disturbance (GMD)-related topics identified in the order. Since that time, NERC developed a preliminary GMD research work plan containing a set of GMD research activities, which will be filed with FERC on May 30, 2017 in accordance with the Order No. 830 directive. The research activities identified in the preliminary plan are expected to advance the understanding of GMD events and the risks these high-impact, low-frequency events pose to the reliability of the BPS. NERC is currently in the process of establishing the administrative components of the GMD research work plan, including the budget, project timeline, and assignment of project responsibilities. NERC expects that executing a GMD research plan of the type contemplated by Order No. 830 would require an extensive, multi-year effort requiring scientific and technical expertise from a variety of disciplines. Managing a large scale research project such as this is not a NERC core competency, which can accentuate and amplify the risks associated with executing the research called for in the plan. Further, NERC expects the costs to have a substantial impact on its budget, and consequently its annual assessments. Therefore, NERC plans to continue to conduct outreach in the coming months with representatives from governmental agencies in the U.S., Europe, and Canada, academia, vendors, and industry to identify the GMD-related work that is currently in progress, determine where opportunities exist for research synergies, develop an appropriate research management structure, and identify alternative sources of funding. NERC will be conducting outreach to stakeholders regarding optimal approaches to structure the funding requirements, including opportunities for sharing costs, research management alternatives, and leveraging research responsibilities. These efforts, along with any comments and Commission guidance, would inform the final scope and structure of NERC s project plan. With this uncertainty of project management and funding alternatives, costs related to this research are not included in the 2018 BP&B. Once the way forward becomes clearer in the next 6-8 months, NERC will develop any additional budgetary materials as needed. E-ISAC Long-Term Strategy Over the past several years the E-ISAC has focused on improving its technical and analytical capabilities with a goal of becoming the electricity industry s leading, trusted source for analysis and sharing of security information. Significant support from the Electricity Subsector Coordinating Council (ESCC), the ESCC Members Executive Committee (MEC), the U.S. Department of Energy, and other stakeholders have helped the E-ISAC be responsive to the industry s needs in order to provide unique insights, leadership, and coordination for security matters. At the request of the NERC Board and under the guidance of the ESCC and MEC, executive leadership of the E-ISAC developed a long-term strategic plan, a copy of which is included as Exhibit F E-ISAC Long- Term Strategy. The E-ISAC Long Term Strategic Plan was approved by the MEC on April 24, 2017 and accepted by the NERC Board of Trustees on May 11, The long-term strategic plan is to transform the E-ISAC into a world-class intelligence collecting and analytical capability for the electricity industry. To carry forth this vision, the E-ISAC is planning a continuous and deliberate growth strategy over the next five years that increases both staff and technical resources. While the 2018 BP&B, in its current form, includes a small increase in staff related primarily to analytical capabilities, the long-term strategy, as 15 FERC Order Reliability Standard for Transmission System Planned Performance for Geomagnetic Disturbance Events 21

25 Introduction and Executive Summary further described in Exhibit F E-ISAC Long-Term Strategy, significantly expands on those resources and those incremental costs are not yet reflected in this 2018 draft budget. The assumptions and projections included herein and that follow for 2019 and 2020 do not include the impacts of the E-ISAC strategic plan discussed in Exhibit F E-ISAC Long-Term Strategy. For 2018, the current draft of the BP&B includes four new positions (3.76 FTEs), including three new analysts to address immediate analytical capabilities and needs. The strategy discussed in that exhibit reflects additional resources, technology, and facilities for the long-term success of the E-ISAC and those additional costs could have a significant impact on these projections. If all the 2018 costs associated with the long-term strategy in Exhibit F E-ISAC Long-Term Strategy were included in the 2018 budget, the budget increase would be 5.1% (vs the current 2.5%) and assessments would increase 6.0% (vs the current 3.3%). Projections for Management is currently developing preliminary operating and fixed asset (capital) projections for 2019 and The significant assumptions considered in preparing these projections include: No increases in total FTEs over the 2018 budget. This assumption does not address the potential impacts of the long-term E-ISAC strategy discussed in Exhibit F E-ISAC Long-Term Strategy. Personnel and benefit cost increases per FTE are consistent with the 2018 budget assumptions Operating costs, including contractor and consulting expenses, are higher due to increases in costs for rent and maintenance costs associated with software applications supporting ERO Enterprise Operations Debt service repayment obligations in connection with the company s Capital Financing Program are consistent with the projected Enterprise IT Applications capital forecast. The most significant work over the next three years will relate to the Compliance Monitoring and Enforcement Technology Program. Current estimates are approximately $5-6M between 2017 and NERC anticipates using the Capital Financing Program as the primary funding source for that project. For additional information on the Compliance Monitoring and Enforcement Technology Program, please see Exhibit G Compliance Monitoring and Enforcement Technology Program. No increase in CRISP-related expenditures, except for personnel and benefit cost increases as noted above NERC s goal is to align assessments and budget increases closely together over the next three to five years. The goal is to minimize fluctuations so that year-to-year variations in receipt of penalties will not cause large variations in future U.S. assessments. Currently, NERC projects assessments to increase 3.3% in 2018, 3.9% in 2019, and 2.1% in 2020 with minimal use from the Assessment Stabilization Reserve to meet these targets. NERC models future periods without assuming the receipt of penalties beyond those NERC currently expects to receive. As penalties are received, NERC assumes that the NERC Board and the Commission will approve the penalties as contributions to the Assessment Stabilization Reserve. 16 [Table showing future budget and assessment increases to be provided in later draft] 16 The company s Working Capital and Operating Reserve Policy requires that in determining the amount of the Assessment Stabilization Reserve that is released each year, the NERC Finance and Audit Committee and Board is to review a three-year forecast of assessments, as well as the availability of funding for the Assessment Stabilization Reserve from surplus funds and penalty funds. The actual contributions to and releases from the Assessment Stabilization Reserve in any year must be approved by the Board and the Commission as part of NERC s annual business plan and budget process, with opportunity for review and input by stakeholders. 22

26 Introduction and Executive Summary Statement of Activities and Fixed Assets Expenditures 2018 Budget & Projected 2019 and 2020 Budgets $ Change % Change 2020 $ Change % Change Budget Projection 19 v v 18 Projection 20 v v 19 Funding ERO Funding NERC Assessments $ 61,804,211 $ 64,959,545 $ 3,155, % $ 66,865,558 $ 1,906, % Assessment Stabilization Reserve - Penalties % % Total NERC Funding $ 61,804,211 $ 64,959,545 $ 3,155, % $ 66,865,558 $ 1,906, % Third-Party Funding (CRISP) $ 7,144,431 $ 7,180,992 $ 36, % $ 7,196,974 $ 15, % Testing Fees 1,790,000 1,790, % 1,790, % Services & Software 50,000 50, % 50, % Workshops 185, , % 185, % Interest 71,500 71, % 71, % Miscellaneous % % Total Funding (A) $ 71,045,141 $ 74,237,037 $ 3,191, % $ 76,159,031 $ 1,921, % Expenses Personnel Expenses Salaries $ 31,020,351 $ 31,934,916 $ 914, % $ 32,876,917 $ 942, % Payroll Taxes 1,891,214 1,913,756 22, % 1,936,022 22, % Benefits 3,873,036 4,013, , % 4,154, , % Retirement Costs 3,148,316 3,242,823 94, % 3,340,164 97, % Total Personnel Expenses $ 39,932,918 $ 41,104,762 $ 1,171, % $ 42,307,397 $ 1,202, % Meeting Expenses Meetings $ 1,071,500 $ 1,071,500 $ - 0.0% $ 1,071,500 $ - 0.0% Travel 2,204,000 2,204, % 2,204, % Conference Calls 119, ,600 20, % 139, % Total Meeting Expenses $ 3,395,100 $ 3,415,100 $ 20, % $ 3,415,100 $ - 0.0% Operating Expenses Consultants & Contracts $ 13,679,185 $ 13,986,529 $ 307, % $ 14,664,707 $ 678, % Office Rent 3,091,804 3,091, % 3,091, % Office Costs 4,978,084 4,881,276 (96,808) -1.9% 4,935,252 53, % Professional Services 2,469,408 2,743, , % 2,673,890 (69,935) -2.5% Miscellaneous 39,500 39, % 39, % Depreciation 1,594,299 1,321,972 (272,326) -17.1% 1,073,181 (248,791) -18.8% Total Operating Expenses $ 25,852,280 $ 26,064,906 $ 212, % $ 26,478,335 $ 413, % Total Direct Expenses $ 69,180,297 $ 70,584,768 $ 1,404, % $ 72,200,832 $ 1,616, % Indirect Expenses $ 0 $ - $ (0) 0.0% $ - $ - 0.0% Other Non-Operating Expenses $ 115,000 $ 169,173 $ 54, % $ 195,111 $ 25, % Total Expenses (B) $ 69,295,297 $ 70,753,941 $ 1,458, % $ 72,395,943 $ 1,642, % Change in Assets $ 1,749,844 $ 3,483,095 $ 1,733, % $ 3,763,089 $ 279, % Fixed Assets Depreciation $ (1,594,299) $ (1,321,972) $ 272, % $ (1,073,181) $ 248, % Computer & Software CapEx 2,501,000 3,251, , % 2,851,000 (400,000) -12.3% Furniture & Fixtures CapEx % % Equipment CapEx 1,175,000 1,480, , % 1,530,000 50, % Leasehold Improvements % % Allocation of Fixed Assets 0 - (0) 0.0% % Inc(Dec) in Fixed Assets (C) $ 2,081,701 $ 3,409,028 $ 1,327, % $ 3,307,819 $ (101,209) -3.0% TOTAL BUDGET (=B+C) $ 71,376,999 $ 74,162,969 $ 2,785, % $ 75,703,762 $ 1,540, % FTEs % % 23

27 Section A 2018 Business Plan and Budget Program Area and Department Detail Reliability Standards Reliability Standards Program (in whole dollars) 2017 Budget 2018 Budget Increase (Decrease) Total FTEs (0.71) Direct Expenses $ 3,861,666 $ 3,533,331 $ (328,335) Indirect Expenses 4,180,279 3,859,068 (321,211) Other Non-Operating Expenses Inc(Dec) in Fixed Assets 58,337 25,226 (33,111) TOTAL BUDGET $ 8,100,282 $ 7,417,626 $ (682,656) Background and Scope The reliability standards program carries out the ERO s statutory responsibility to develop, adopt, obtain approval of, and modify (as and when appropriate) mandatory reliability standards (both continent-wide standards and regional reliability standards) for the reliable planning, operation, and critical infrastructure protection of the North American BES. The major activities undertaken by the Standards department include: Delivering high-quality, continent-wide reliability standards: NERC standard developers and other standards staff provide project management and leadership to develop solutions necessary to address reliability risks identified through the Reliability Risk Management Process (RRMP). These may include the development of, or modifications to, NERC reliability standards through standard development outreach activities, facilitation of drafting team activities, drafting support, assisting drafting teams in maintaining adherence to the development process as outlined in the Standard Processes Manual, and ensuring that the quality of documents produced is appropriate for approval by industry and the Board. Facilitating continent-wide industry engagement: NERC manages the work of over 200 industry contributors who serve on the Standards Committee, subgroups, and other project teams for the development of NERC reliability standards through the standards development program. Conducting balloting, disseminating information, and supporting regulatory filings: Through NERC s commenting and ANSI-accredited balloting process, industry consensus is built by engaging thousands of industry volunteers within hundreds of registered entities throughout North America who review, comment on, and approve the standards created by the standard drafting teams. The department also supports the filing of standards with applicable regulatory authorities and provides support with regulatory proceedings. The reliability standards program provides a mechanism for the eight Regional Entities to process regional standards when unique regional reliability gaps are detected, or incorporate Regional variances into continent-wide standards. The NERC Standards department staff supports regional standards development processes by providing technical advice, final quality review of regional standards, presentation to the Board, and preparation of regional standards materials for submission for standard adoption to the applicable regulatory authorities in the U.S. and Canada. 24

28 Section A 2018 Business Plan and Budget Program Area and Department Detail Stakeholder Engagement and Cost Effectiveness Project As part of the standard development process, industry technical experts scope, draft, and review the new or revised NERC reliability standards for approval by the industry ballot body, adoption by the Board, and filing with regulatory authorities in the U.S. and Canada. Additionally, Federal, State and Provincial regulatory authorities, the NERC Board, Regional Entities, and many industry stakeholders have expressed interest in the identification of costs incurred from implementing NERC reliability standards compared to risks they address. The objective is to ensure that these elements are considered during the standards development and revision process. A pilot was conducted in 2016 to develop an approach to determine the level of cost versus the reliability benefit to mitigate an identified risk. Work will continue in 2017 on refining the approach and developing additional means to evaluate cost impacts of the existing body of standards. Key Efforts Underway NERC will ensure that the Reliability Standards Development Plan (RSDP) is effectively executed and that reliability standards are focused on and mitigate significant risks to BES reliability. Department resources will be focused on supporting the ERO Enterprise Strategic Plan, including but not limited to support of the RRMP and resolving FERC directives. The Standards department will: 1. Focus on the selection of projects undertaken. Resources will be expended on issues determined to be a reliability risk through the RRMP (also see the Reliability Assessment and System Analysis section and the Performance Analysis section below for additional detail). The department will apply broader project management skills to implement a variety of solutions to a reliability concern. An effective solution to an identified reliability risk may be a Reliability Standard, or it may be a guideline, information request, training, NERC Alert, technical conference, research, or a combination of these or other tools. 2. Address FERC directives and respond to FERC orders through standards development projects, as necessary. Each project will determine whether: (1) the directive will be complied with as issued, (2) there is an equally effective and efficient way to address the concern that fostered the directive, or (3) there is technical justification (including that the directive has been overcome by events, processes, or advances in technology) that resolution of the directive is no longer needed. 3. Perform periodic reviews. In 2017, industry and NERC will determine whether there is a need to make further improvements to the standards through periodic reviews that include: (1) a measured review of the content of standards, considering whether the requirements could more effectively mitigate risks to the BPS, (2) whether the standards are results based and drafted with high quality, (3) whether the standards are concise or if the number of requirements could be reduced, and (4) whether compliance expectations are clear. 4. Facilitate smooth transition to new standards. This includes working with the Compliance Monitoring and Enforcement and Organization Registration and Certification, Reliability Assessment and System Analysis, and Performance Analysis programs to develop guidelines, webinars, and other activities to support auditor and industry training for the new standards. The RSDP will be developed in 2017 in conjunction with the Standards Committee, RISC, and RRMP. It will outline the work plan for the continued evaluation of NERC reliability standards, the Standards department s support of Reliability Risk Management, and resolution of FERC directives. Additionally, standards grading metrics will be used to measure the overall quality of each enforceable reliability standard as a basis for measuring needed improvements. 25

29 Section A 2018 Business Plan and Budget Program Area and Department Detail 2018 Goals and Deliverables In 2016, the majority of FERC directives were addressed, as well as the remaining recommendations for retiring requirements made by the Paragraph 81 project and the independent experts. In 2017, the body of standards will be reviewed for potential improvements while considering quality and content criteria, as well as results-based standards principles. The NERC Standards staff will continue to address any new directives issued by FERC, as well any reliability risks identified through RRMP or by the RISC for which a reliability standard is part of the solution. Resource Requirements Personnel The 0.71 reduction in FTEs is the result of resource allocations that began in 2016 and will continue throughout 2017 in an attempt to realign staff with current needs. Contractors and Consultants No contractor and consulting support is budgeted in 2018, which is consistent with the 2017 budget. 26

30 Section A 2018 Business Plan and Budget Program Area and Department Detail Statement of Activities and Fixed Assets Expenditures 2017 Budget & Projection, and 2018 Budget RELIABILITY STANDARDS Variance Variance 2017 Projection 2018 Budget v 2017 Budget 2018 v 2018 Budget Budget Projection Over(Under) Budget Over(Under) Funding ERO Funding NERC Assessments $ 7,835,213 $ 7,835,213 $ 0 $ 7,359,153 $ (476,060) Assessment Stabilization Reserve - Penalties 159, , (159,642) Total NERC Funding $ 7,994,855 $ 7,994,855 $ 0 $ 7,359,153 $ (635,703) Third-Party Funding $ - $ - $ - $ - $ - Testing Fees Services & Software Workshops 105, ,000-50,000 (55,000) Interest 427 8,684 8,257 8,473 8,046 Miscellaneous Total Funding $ 8,100,282 $ 8,108,539 $ 8,257 $ 7,417,626 $ (682,656) Expenses Personnel Expenses Salaries $ 2,340,405 $ 2,271,025 $ (69,380) $ 2,374,041 $ 33,635 Payroll Taxes 151, ,935 (8,723) 155,763 4,105 Benefits 307, ,669 (22,416) 304,783 (2,302) Retirement Costs 259, ,994 (12,413) 264,171 4,763 Total Personnel Expenses $ 3,058,556 $ 2,945,623 $ (112,932) $ 3,098,757 $ 40,201 Meeting Expenses Meetings $ 207,000 $ 207,000 $ (0) $ 105,000 $ (102,000) Travel 271, ,000 (17,988) 240,000 (31,988) Conference Calls 40,565 10,000 (30,565) - (40,565) Total Meeting Expenses $ 519,553 $ 471,000 $ (48,554) $ 345,000 $ (174,553) Operating Expenses Consultants & Contracts $ - $ - $ - $ - $ - Office Rent Office Costs 51,336 51, ,796 (1,540) Professional Services Miscellaneous Depreciation 231, , ,278 (192,443) Total Operating Expenses $ 283,556 $ 283,557 $ 0 $ 89,574 $ (193,983) Total Direct Expenses $ 3,861,666 $ 3,700,180 $ (161,486) $ 3,533,331 $ (328,335) Indirect Expenses $ 4,180,279 $ 4,240,100 $ 59,820 $ 3,859,068 $ (321,211) Other Non-Operating Expenses $ - $ - $ - $ - $ - Total Expenses (A) $ 8,041,945 $ 7,940,280 $ (101,665) $ 7,392,399 $ (649,546) Change in Assets $ 58,337 $ 168,260 $ 109,923 $ 25,226 $ (33,111) Fixed Assets Depreciation $ (231,721) $ (231,721) $ (0) $ (39,278) $ 192,443 Computer & Software CapEx - 65,000 65, Furniture & Fixtures CapEx Equipment CapEx Leasehold Improvements Allocation of Fixed Assets 290, ,578 (169,480) 64,504 (225,553) Inc(Dec) in Fixed Assets (B) $ 58,337 $ (46,143) $ (104,480) $ 25,226 $ (33,111) TOTAL BUDGET (=A+B) $ 8,100,282 $ 7,894,137 $ (206,145) $ 7,417,626 $ (682,656) FTEs (0.55) (0.71) 27

31 Section A 2018 Business Plan and Budget Program Area and Department Detail Compliance Monitoring and Enforcement and Organization Registration and Certification The Compliance Monitoring and Enforcement, and Organization Registration and Certification program areas purpose is to monitor, enforce, and ensure registered entity compliance with the ERO s mandatory reliability standards. This program area is addressed by three operational groups: 1) Compliance Assurance (addressing compliance monitoring), 2) Compliance Analysis, Certification and Registration (addressing assurance, organization registration and certification), and 3) Compliance Enforcement. Compliance Assurance Compliance Assurance (in whole dollars) 2017 Budget 2018 Budget Increase (Decrease) Total FTEs Direct Expenses $ 3,816,924 $ 4,342,311 $ 525,386 Indirect Expenses 3,779,431 4,300, ,674 Other Non-Operating Expenses Inc(Dec) in Fixed Assets 262,244 71,876 (190,368) TOTAL BUDGET $ 7,858,599 $ 8,714,292 $ 855,693 Background and Scope Compliance Assurance addresses the Regional Entities implementation of the compliance monitoring section of the CMEP. NERC s Compliance Assurance group works collaboratively with the eight Regional Entities to ensure effective implementation of risk-based compliance monitoring under the CMEP across the entire ERO Enterprise. This program ensures that Regional Entities monitor registered entities for compliance according to their own specific facts and circumstances, including the entity s inherent risks, evaluation of controls in place to mitigate the inherent risks, and any aggravating factors. The CMEP provides for Regional Entities to develop customized compliance oversight plans (COPs) for each registered entity that identifies: 1) the standards or requirements to be monitored, 2) the monitoring processes (tools) for use by the Regional Entities, including compliance audits, self-certification, spot checking, self-reporting, and 3) the interval of monitoring. NERC and the Regional Entities ensure that inherent risk assessments (IRAs) for registered entities begin with a consistent framework and that Regional Entities implementation of the CMEP coalesce around best practices, data management procedures that address data reporting requirements, integrity, retention, security, and confidentiality. The Compliance Assurance group s responsibilities include but are not limited to the following major activities and functions: Oversight of the Regional Entities implementation of the risk-based compliance monitoring program and NERC ROP in North America; Development and execution of the annual CMEP Implementation Plan (IP); Oversight of the use of necessary compliance-related processes, procedures, IT platforms, tools, and templates; Development and delivery of education and training for ERO Enterprise staff; 28

32 Section A 2018 Business Plan and Budget Program Area and Department Detail Critical Infrastructure Protection (CIP) Version 5 Reliability Standards and subsequent enhancements to the CIP Standards activities related to education programs that support industry compliance and security; CIP training and outreach activities related to effective implementation of the Physical Security Reliability Standard; Coordination with the NERC Standards department for standard development to assist in the smooth transition for standards from development to enforceability and feedback on risks seen in the field that are not addressed by a standard, as well as information on where a standard is too broad; and Support for Regional Entity and industry committees, working groups, and task forces, such as the NERC CCC and NERC Critical Infrastructure Protection Committee (CIPC). Strategic Goal Related to CMEP Strategic Goal 2: Objective and Risk-informed Compliance Monitoring, Enforcement, and Organization Certification and Registration Goal Description: The ERO Enterprise is a strong enforcement authority that is objective, fair, and promotes a culture of reliability excellence through risk-informed compliance monitoring, enforcement, certification, and registration. The risk-based compliance monitoring approach allows for the appropriate allocation of resources to the issues that pose a higher level of risk to the reliability of the BPS. Stakeholder Engagement and Benefit NERC continues to promote the Regional Entities development of customized COPs for registered entities. As the risk-based compliance monitoring approach was implemented in 2015 and 2016, Regional Entities worked closely with stakeholders to develop IRAs and appropriately scope compliance monitoring activities. As this process continues to mature, Regional Entities will continue to customize compliance monitoring tools and frequency of monitoring for each registered entity, based on its IRA as well as additional considerations such as risk elements, entity performance, internal controls, and mitigating activities to inform the development of their COPs. Compliance Assurance continues to work closely with the standard development program to provide compliance information, statistics, and perspectives to drafting teams fostering the development of standards that provide an increased reliability benefit and clarify compliance risks. This collaboration with industry and Standards department staff will occur early in the standard development process by providing draft compliance monitoring guidance, including information on how compliance with draft standards will be determined, as well as input to the drafting teams on the auditability and enforceability of the draft standards. This will ensure that ERO Enterprise tools used in the auditing process, such as the reliability standards auditing worksheet (RSAW), do not expand or modify standards requirements. NERC also continues to provide industry-focused outreach events and webinars on the ERO Enterprise s approaches to risk-based CMEP activities. The ERO Enterprise staff will continue its webinar series providing guidance on standards and requirements associated with the 2017 risk elements identified for consideration for compliance monitoring. 29

33 Key Efforts Underway Risk-Based CMEP Implementation Section A 2018 Business Plan and Budget Program Area and Department Detail Ensuring the successful implementation of NERC s risk-based CMEP remains the priority of Compliance Assurance s oversight plan. As part of that oversight, and in addition to offering regular feedback to the Regional Entities, NERC will continue to identify areas for improvement or promoting consistency through training, guidance, or adjustments during the following year. NERC also produces an ERO Enterprise CMEP annual report, which includes an assessment of the risk-based CMEP implementation. NERC performs oversight of the Regional Entities compliance monitoring programs primarily through the review of the processes, supporting evidence, observations, and other information provided by the Regional Entities over the course of focused engagements of program areas that are scheduled throughout the year. NERC communicates the recommendations and findings to the Regional Entities to help the ERO Enterprise develop responsive strategies and solutions to potential issues and ensure uniform and consistent implementation of the CMEP. Such recommendations and findings also help identify priority areas for training of ERO Enterprise staff during the year. NERC Oversight of Risk-Based Compliance Monitoring Consistent with the goals and objectives set forth in the strategic plan, NERC will continue to implement risk-based compliance monitoring and enforcement as part of its stated objectives of ensuring BES reliability, consistency, improving the efficiency and effectiveness of NERC and Regional Entity compliance and enforcement operations, focusing on identified risks and reducing unnecessary burdens on registered entities. CIP Compliance NERC and the Regional Entities continue to manage the smooth implementation of compliance activities for CIP Version 5 and subsequent enhancements to the CIP Standards by providing training, webinars, and other forms of outreach. The ERO Enterprise will continue to provide educational programs to support industry compliance and the integration of risk assessment and internal controls. In addition, NERC and the Regional Entities will continue supporting the successful implementation and monitoring of the physical security reliability standard. Compliance Monitoring and Enforcement Process Tool For 2017 and through the budget cycle, NERC will develop and implement CMEP Process tool that supports the CMEP, including the various processes and activities of the compliance and enforcement program (e.g., analysis of risk, development of implementation plans and audit schedules, actual compliance monitoring, and enforcement processing). Regional Entity Training NERC Compliance Assurance will provide training to Regional Entity staff on the most important elements of risk-based compliance monitoring, including enhancements to registered entity IRAs, internal controls reviews, compliance oversight plan development, as well as Reliability Standards monitoring. NERC will develop this training based on observations from its oversight activities of the Regional Entities, as well as the process reviews described above. Emerging Technology Roundtables NERC Compliance Assurance will continue to periodically host an Emerging Technology Roundtable with industry and vendors that includes in-depth discussions around the integration of emerging technologies associated with BPS operations to address and mitigate cyber and physical security risks of the BPS. 30

34 Section A 2018 Business Plan and Budget Program Area and Department Detail 2018 Goals and Deliverables The Compliance Assurance group has several goals and deliverables that support the ERO Enterprise Strategic Plan. Resources will be focused on improvements implemented as a result of the riskbased compliance monitoring activities in 2016 and Specific 2018 objectives for this group are: Continue to mature the risk-based compliance monitoring program, including ongoing oversight of the risk-based CMEP, including IRAs, consideration of internal controls, coordinated oversight of multi-region registered entities, and ensuring that COPs are addressing the relevant risks. Work closely with NERC s Enforcement and IT departments, as well as staff in the Regional Entities, to help develop application business requirements and to test business functionality for ERO Enterprise CMEP Process Tool. Support the continued successful implementation of the CIP Version 5 Reliability Standards and subsequent enhancements that become effective in 2017 and beyond. Continue to monitor and support effective implementation of the Physical Security Reliability Standard. Continue to enhance and implement training to support monitoring of Reliability Standards, integrating principles from the ERO Auditor Capabilities and Competencies Guide. Continue feedback to Standards through integration and coordination between the standards and compliance functions for clear stakeholder implementation and feedback on risks seen in the field that are not addressed by a standard, as well as information on where a standard is too broad. This effort will be supported through common set of RSAWs, guidance, and outreach. Support International CMEP activities including reliability and security subject matter expertise and outreach. Provide support and leadership to (1) the CIPC and (2) standing committees subcommittees, working groups, and task forces serving the standing committee. Support the CIPC leadership and development and implementation of the annual CIPC work plan. Provide support and leadership to (1) the CCC and (2) standing committees subcommittees, working groups, and task forces serving the standing committee. Support the CCC leadership and the development and implementation of the annual CCC work plan. These 2018 activities are necessary to further implement risk-based compliance monitoring, including the CIP standards, and integrate the standards and compliance functions. A number of activities that support the implementation of the strategic risk-based reforms are intended to reduce regulatory burden by focusing monitoring according to each registered entity s potential impact on the BPS. Resource Requirements Personnel The 2.82 increase in Compliance Assurance FTEs, which is reflective of reallocating resources from other departments to this one, is the result of NERC s plan to strengthen the implementation and oversight of the risk-based CMEP, risk analysis, and feedback loops. This includes: Data analysis and trending for emerging reliability and security risks; Support the development of the CMEP process tool to improve documentation, sharing, analysis, and more closely align CMEP processes; Identification and mitigation of significant risks; 31

35 Section A 2018 Business Plan and Budget Program Area and Department Detail Subject matter expertise for training and oversight of Reliability Standards; Participation and input into the Reliability Standards process including providing compliance and subject matter expertise; Support international compliance activities; and Support the NERC CIPC. Contractors and Consultants Funds budgeted for outside consultants to assist in successful implementation of risk-based compliance monitoring remains unchanged at $50k. Further information is provided in Exhibit C Contractor and Consulting Costs. Some consultant resources continue to be needed to support the transformation of NERC s Compliance Monitoring and Enforcement Program to a risk-based design. The IT budget includes funding for the maintenance of existing software tools supporting compliance assessment, registration, certification, and enforcement activities, as well as the investigation and development of a business case for future tools supporting ERO Enterprise compliance assessment, registration, and certification and enforcement activities. 32

36 Section A 2018 Business Plan and Budget Program Area and Department Detail Statement of Activities and Fixed Assets Expenditures 2017 Budget & Projection, and 2018 Budget COMPLIANCE ASSURANCE Variance Variance 2017 Projection 2018 Budget v 2017 Budget 2018 v 2018 Budget Budget Projection Over(Under) Budget Over(Under) Funding ERO Funding NERC Assessments $ 7,713,879 $ 7,713,879 $ 0 $ 8,703,882 $ 990,003 Assessment Stabilization Reserve - Penalties 144, , (144,334) Total NERC Funding $ 7,858,213 $ 7,858,213 $ 0 $ 8,703,882 $ 845,669 Third-Party Funding $ - $ - $ - $ - $ - Testing Fees Services & Software Workshops Interest 386 8,876 8,490 10,410 10,024 Miscellaneous Total Funding $ 7,858,599 $ 7,867,089 $ 8,490 $ 8,714,292 $ 855,693 Expenses Personnel Expenses Salaries $ 2,509,618 $ 2,812,383 $ 302,765 $ 2,813,753 $ 304,135 Payroll Taxes 163, ,005 19, ,111 18,776 Benefits 333, ,398 16, ,274 38,717 Retirement Costs 276, ,138 38, ,610 35,337 Total Personnel Expenses $ 3,282,783 $ 3,660,924 $ 378,141 $ 3,679,748 $ 396,964 Meeting Expenses Meetings $ 60,000 $ 60,000 $ 0 $ 200,000 $ 140,000 Travel 276, , ,000 98,657 Conference Calls 6,100 1,000 (5,100) - (6,100) Total Meeting Expenses $ 342,443 $ 337,343 $ (5,099) $ 575,000 $ 232,557 Operating Expenses Consultants & Contracts $ 50,000 $ 35,800 $ (14,200) $ 50,000 $ 0 Office Rent Office Costs 141, ,198 (0) 37,063 (104,135) Professional Services Miscellaneous Depreciation Total Operating Expenses $ 191,698 $ 177,498 $ (14,200) $ 87,563 $ (104,135) Total Direct Expenses $ 3,816,924 $ 4,175,765 $ 358,841 $ 4,342,311 $ 525,386 Indirect Expenses $ 3,779,431 $ 3,833,512 $ 54,081 $ 4,300,105 $ 520,674 Other Non-Operating Expenses $ - $ - $ - $ - $ - Total Expenses (A) $ 7,596,355 $ 8,009,277 $ 412,923 $ 8,642,415 $ 1,046,060 Change in Assets $ 262,244 $ (142,189) $ (404,433) $ 71,876 $ (190,368) Fixed Assets Depreciation $ - $ - $ - $ - $ - Computer & Software CapEx Furniture & Fixtures CapEx Equipment CapEx Leasehold Improvements Allocation of Fixed Assets 262, ,016 (153,228) 71,876 (190,368) Inc(Dec) in Fixed Assets (B) $ 262,244 $ 109,016 $ (153,228) $ 71,876 $ (190,368) TOTAL BUDGET (=A+B) $ 7,858,599 $ 8,118,293 $ 259,694 $ 8,714,292 $ 855,693 FTEs

37 Section A 2018 Business Plan and Budget Program Area and Department Detail Compliance Analysis, Organization Registration and Certification Compliance Analysis, Organization Registration and Certification (in whole dollars) 2017 Budget 2018 Budget Increase (Decrease) Total FTEs Direct Expenses $ 1,686,689 $ 2,146,823 $ 460,134 Indirect Expenses 1,832,451 2,205, ,731 Other Non-Operating Expenses Inc(Dec) in Fixed Assets 127, , ,711 TOTAL BUDGET $ 3,646,289 $ 4,988,865 $ 1,342,576 Background and Scope The Compliance Analysis, Registration and Certification group is responsible for a range of requirements and activities embodied in Section 500 (Organization Registration and Certification) and Appendices 5A and 5B of the NERC ROP. The group provides technical resource support to standards development, compliance monitoring, and enforcement and (1) ensures that all entities impacting the BES are registered commensurate with risk, (2) ensures that all Reliability Coordinators (RCs), Transmission Operators (TOPs), and Balancing Authorities (BAs) are certified, (3) conducts industry reliability assurance activities, and (4) ensures that compliance gaps identified in reportable events are assessed and addressed if appropriate. Specific activities of the group include: Registration Identifies and registers BES users, owners, and operators who are responsible for compliance with reliability standards. Organizations that are registered are included on the NERC Compliance Registry (NCR) and are responsible for knowing the content of and complying with all applicable reliability standards. Maintains the current registration for the entire ERO for entities as they take on and drop functional responsibilities. Certification Evaluates and certifies the competency of reliability entities (i.e., those that perform certain key reliability functions, specifically the RC, BA, and TOP functions). Entities performing these three functions must be evaluated for having the necessary personnel, knowledge, facilities, programs, and other qualifications to carry out these important responsibilities, including demonstrating the ability to meet the requirements and subrequirements of all of the reliability standards applicable to the reliability function(s). This also includes confirming through the certification review process that a reliability entity continues to have the qualifications mentioned above following planned material changes to that entity s operation. Reliability Assurance Conducts reliability assurance activities, including: o o o Reliability Assurance Conducts activities to reasonably assure the ERO that certain actions have been taken as reported in response to NERC Alerts or guidance to industry. Oversight Provides oversight of Regional Entity implementation of regional registration, compliance, certification, investigation, complaint programs, and processes. Investigations Conducts non-public, confidential investigations to identify Possible Violations of NERC reliability standards in response to complaints, BES disturbances, or other similar triggers. The Compliance Analysis, Certification and Registration staff participates on all Regional Entity-led investigations and observers as requested on FERCled reliability investigations and inquiries. 34

38 Section A 2018 Business Plan and Budget Program Area and Department Detail o o Compliance evaluations Works closely with regional staff to confirm that qualified events and disturbances are evaluated against the relevant approved reliability standards and ensure formal compliance monitoring occurs if indicated. These analyses are also shared with FERC staff. Complaints Addresses formal complaints that allege the violation of reliability standards, through a confidential process. Key Efforts Underway In 2016, NERC registration conducted a program review to identify areas for improvements. These areas included: Conducting NERC-led Review Panels and identifying process improvements; NERC ROP changes; Coordinating Functional Registration research on process and model efficiencies; Supporting the entity registration xrm database initiative; Doing a thorough review of the NERC website for any modifications; Reviewing internal processes and procedures; and Continuing Regional Entity oversight activities. NERC Reliability Assurance, in conjunction with Regional Entities, performed a review of the Certification program in 2016 regarding its effectiveness in determining an entity s ability to become certified and then operational, and to begin to incorporate changes to the program, if applicable, based on the outcomes of the review. The team concluded that the certification process is necessary and is effective in determining an entity's ability to become certified and operational. The team recommended two improvements to the existing certification process which will be acted on in Clearly establish the focus on certification on evaluation of an entity's capability to perform the reliability function of transmission operator, balancing authority, and/or reliability coordinator through the use of standard templates to be used by each Regional Entity's certification team. Conduct an evaluation of the certification review process to determine effectiveness of the current triggers of the certification review, execution of the actual process and affect any needed ROP changes. Continue Regional Entity oversight activities Goals and Deliverables The Compliance Analysis, Certification and Registration group has several goals and deliverables that support the ERO Enterprise Strategic Plan and Metrics. Resources will be focused on building upon the improvements identified in Specific 2018 objectives for this group are: Continue to determine the NERC-led Review Panel decisions. Continue to implement registration program improvements identified in the 2016 project and conduct any additional actions identified by the project. Implement certification program improvements identified in the 2016 project and conduct training as necessary. Evaluate BES disturbances and events for potential gaps in compliance monitoring or reliability standards. 35

39 Resource Requirements Section A 2018 Business Plan and Budget Program Area and Department Detail Personnel The 1.88 increase in FTEs is the result of resource allocations that began in 2016 and will continue throughout 2017 in an attempt to realign staff with current needs. Contractor Expenses No contractor and consulting support is budgeted in 2018, which is consistent with the 2017 budget. 36

40 Section A 2018 Business Plan and Budget Program Area and Department Detail Statement of Activities and Fixed Assets Expenditures 2017 Budget & Projection, and 2018 Budget COMPLIANCE ANALYSIS, ORGANIZATION REGISTRATION and CERTIFICATION Variance Variance 2017 Projection 2018 Budget v 2017 Budget 2018 v 2018 Budget Budget Projection Over(Under) Budget Over(Under) Funding ERO Funding NERC Assessments $ 3,576,122 $ 3,576,122 $ (0) $ 4,983,539 $ 1,407,417 Assessment Stabilization Reserve - Penalties 69,980 69, (69,980) Total NERC Funding $ 3,646,102 $ 3,646,102 $ (0) $ 4,983,539 $ 1,337,437 Third-Party Funding $ - $ - $ - $ - $ - Testing Fees Services & Software Workshops Interest 187 5,363 5,176 5,326 5,139 Miscellaneous Total Funding $ 3,646,289 $ 3,651,465 $ 5,176 $ 4,988,865 $ 1,342,576 Expenses Personnel Expenses Salaries $ 1,125,154 $ 1,460,245 $ 335,091 $ 1,513,647 $ 388,492 Payroll Taxes 76,383 92,639 16,256 95,222 18,839 Benefits 174, ,981 12, ,835 20,821 Retirement Costs 126, ,786 29, ,186 41,534 Total Personnel Expenses $ 1,502,203 $ 1,895,652 $ 393,449 $ 1,971,889 $ 469,686 Meeting Expenses Meetings $ 4,000 $ 4,000 $ (0) $ 2,250 $ (1,750) Travel 155, ,000 19, ,500 (4,646) Conference Calls (495) - (610) Total Meeting Expenses $ 159,756 $ 179,114 $ 19,359 $ 152,750 $ (7,006) Operating Expenses Consultants & Contracts $ - $ - $ - $ - $ - Office Rent Office Costs 24,231 24,231 (1) 21,684 (2,547) Professional Services Miscellaneous Depreciation Total Operating Expenses $ 24,731 $ 24,731 $ (1) $ 22,184 $ (2,547) Total Direct Expenses $ 1,686,689 $ 2,099,496 $ 412,807 $ 2,146,823 $ 460,134 Indirect Expenses $ 1,832,451 $ 1,858,673 $ 26,221 $ 2,205,182 $ 372,731 Other Non-Operating Expenses $ - $ - $ - $ - $ - Total Expenses (A) $ 3,519,141 $ 3,958,169 $ 439,028 $ 4,352,005 $ 832,864 Change in Assets $ 127,149 $ (306,704) $ (433,852) $ 636,860 $ 509,711 Fixed Assets Depreciation $ - $ - $ - $ - $ - Computer & Software CapEx - 125, , , ,000 Furniture & Fixtures CapEx Equipment CapEx Leasehold Improvements Allocation of Fixed Assets 127,149 52,856 (74,292) 36,860 (90,289) Inc(Dec) in Fixed Assets (B) $ 127,149 $ 177,856 $ 50,708 $ 636,860 $ 509,711 TOTAL BUDGET (=A+B) $ 3,646,289 $ 4,136,025 $ 489,736 $ 4,988,865 $ 1,342,576 FTEs

41 Section A 2018 Business Plan and Budget Program Area and Department Detail Compliance Enforcement Compliance Enforcement (in whole dollars) 2017 Budget 2018 Budget Increase (Decrease) Total FTEs (0.94) Direct Expenses $ 2,371,347 $ 2,456,993 $ 85,646 Indirect Expenses 3,206,790 2,866,736 (340,053) Other Non-Operating Expenses Inc(Dec) in Fixed Assets 222,510 1,442,904 1,220,394 TOTAL BUDGET $ 5,800,647 $ 6,766,633 $ 965,986 Background and Scope The Compliance Enforcement department is responsible for overseeing enforcement processes, the application of penalties or sanctions, and activities to mitigate and prevent recurrence of noncompliance with reliability standards. The Compliance Enforcement department works collaboratively with the eight Regional Entities to ensure consistent and effective implementation of the risk-based Compliance Monitoring and Enforcement Program. Importantly, the department also focuses on ensuring that the ERO Enterprise dedicates resources to the matters that pose the greatest risk to reliability. The NERC Compliance Enforcement department performs its responsibilities by: Monitoring Regional Entities enforcement processes and providing oversight over their outcomes to ensure due process, to identify best practices and process efficiency opportunities, and to promote consistency among Regional Entities business practices; Collecting and analyzing compliance enforcement data and trends to assist with the identification of emerging risks and to help inform the development of enforcement policies and processes; Filing notices of penalty and other submittals associated with noncompliance discovered through Regional Entity compliance monitoring and enforcement activities; Processing and filing notices of penalty and other submittals associated with violations discovered through NERC-led investigations and audits; Collaborating with other NERC departments, including Compliance Assurance, Standards, Event Analysis, and Regional Entity Coordination; and Delivering training of the ERO Enterprise staff and registered entities, as well as supporting other outreach efforts. The ERO Enterprise s enforcement jurisdiction is drawn from the Energy Policy Act of 2005 (the Act), which added Section 215 to the Federal Power Act (FPA). Section 215 made compliance with electric reliability standards mandatory and authorized the creation of an ERO and Regional Entities to establish and enforce reliability standards. Under section 215(e)(1) of the FPA, NERC or a Regional Entity may impose a penalty on a user, owner, or operator of the BPS for a violation of a Reliability Standard approved by FERC. As the ERO, NERC has set forth Sanction Guidelines outlined in its ROP that govern the ERO Enterprise s penalties and non-monetary sanctions for Reliability Standard violations. This document provides information on the ERO Enterprise s enforcement philosophy, i.e., the ERO Enterprise s approach for assessing and resolving noncompliance while continuing to work to bring entities into compliance with applicable Reliability Standards. 38

42 Section A 2018 Business Plan and Budget Program Area and Department Detail ERO Enterprise Core Values and Guiding Principles The ERO Enterprise s Strategic Plan promotes the ERO Enterprise s core values and guiding principles. A goal of the ERO Enterprise is to be a strong enforcement authority that is objective, fair, and promotes a culture of reliability excellence through risk-informed compliance monitoring, enforcement, certification, and registration. The following principles serve as guidelines for the conduct and behavior of all involved in the ERO Enterprise enforcement program to ensure alignment with this goal and with the ERO Enterprise s core values. Compliance Enforcement Authorities are independent, without conflict of interest, objective, and fair. The ERO Enterprise strives to be a strong enforcement authority that is independent, without conflict of interest, objective, and fair. NERC and each of the Regional Entities has a code of conduct addressing the professional and ethical standards applicable to its personnel. Foremost among these standards is the requirement that no person work on a matter where that work may affect the person s financial interest. The ERO Enterprise also expects its personnel to conduct themselves professionally and respectfully when engaging with registered entities or other stakeholders. Personnel who do not meet these standards are subject to discipline, up to and including termination. Enforcement program promotes culture of reliability excellence through a risk-based approach. The ERO Enterprise s risk-based enforcement philosophy generally advocates reserving enforcement actions under section 5.0 of the Compliance Monitoring and Enforcement Program for those issues that pose a higher risk to the reliability of the BPS. The risk of a noncompliance is determined based on specific facts and circumstances, including any controls in place at the time of the noncompliance. The ERO Enterprise works with registered entities to ensure timely remediation of potential risks to the reliability of the BPS and prevent recurrence of noncompliance. The enforcement process allows parties to address risks collaboratively and promote increased compliance and reliability through improvement of programs and controls at the registered entities. The ERO Enterprise applies a presumption of non-enforcement treatment of minimal risk noncompliance to entities with demonstrated internal controls who are permitted to self-log such minimal risk issues. Regarding other issues posing a minimal risk, NERC and the Regional Entities may exercise appropriate judgment whether to initiate a formal enforcement action or resolve the issue outside of the formal enforcement processes. The availability of streamlined treatment of minimal risk noncompliance outside of the formal enforcement process encourages self-inspection by registered entities. When self-identified minimal risk noncompliance is more than likely not going to be subject to a financial penalty, registered entities are encouraged to establish more robust internal controls for the detection and correction of noncompliance. This approach allows the ERO Enterprise to oversee the activities of registered entities in a more efficient manner and to focus resources where they result in the greatest benefit to reliability. In this context, efficiency does not necessarily mean less time or effort. Rather, it is using the requisite time, knowledge, and skills required for each circumstance. In addition, this approach allows the ERO Enterprise to continue to provide clear signals to registered entities about identified areas of concern and risk prioritization, while maintaining existing visibility into potential noncompliance and emerging areas of risk. Outcomes for noncompliance are based on the risk of a specific noncompliance and may range from streamlined, non-enforcement processes, to significant monetary penalties. Enforcement actions are used and penalties are imposed when warranted, commensurate with risk. An element of a risk-based approach to enforcement is accountability of registered entities for their noncompliance. No matter the risk of the noncompliance, the registered entity still bears the responsibility of mitigating that noncompliance. Based on the risk, facts, and circumstances associated 39

43 Section A 2018 Business Plan and Budget Program Area and Department Detail with that noncompliance, the Regional Entity decides on an appropriate disposition track, inside or outside of an enforcement action, as described above, and whether a penalty is appropriate for the noncompliance. Penalties are generally warranted for serious risk violations (e.g., uncontrolled loss of load, CIP program failures) and for when repeated noncompliance constitutes an aggravating factor. In addition to the use of significant penalties to deter undesired behavior, the ERO Enterprise also incents desired behaviors. 17 Specifically, Regional Entities may offset penalties to encourage valued behavior. Factors that may mitigate penalty amounts include registered entity cooperation, accountability (including admission of violations), culture of compliance, and self-identification of noncompliance. Regional Entities may also grant credit in enforcement determinations for certain actions undertaken by registered entities for improvements in addition to mitigating factors. For example, Regional Entities may consider significant investments in reliability made by registered entities, beyond those otherwise planned and required, as an offset for proposed penalties in enforcement determinations. Regional Entities do not award credits or offsets for actions or investments undertaken by a registered entity that are required to mitigate noncompliance. NERC engages in regular oversight of Regional Entity enforcement activities to confirm that the Regional Entities have followed the CMEP. This oversight evaluates the consistency of disposition methods, including assessment of a penalty or sanction, with previous resolutions of similar noncompliance involving similar circumstances. The NERC Board Compliance Committee (the Compliance Committee) considers the recommendations of NERC staff regarding approval of Full Notices of Penalty (NOP) and monitors the handling of noncompliance through the streamlined disposition methods of Spreadsheet NOPs, FFTs, and Compliance Exceptions. Actions are timely and transparent. NERC s ROP (including the CMEP and Sanction Guidelines) and program documents are available to the public. 18 NERC also posts information on enforcement actions on a monthly basis. 19 Moreover, information on the efficiency of the enforcement program is available to regulators, industry stakeholders and the public on a quarterly basis. 20 Noncompliance information is used as an input to other processes. When developing risk elements, NERC annually identifies and prioritizes risks to the reliability of the BPS, taking into account factors such as compliance findings, event analysis experiences, and data analysis. In addition, Regional Entities consider factors such as noncompliance information when conducting an IRA of a registered entity. The ERO Enterprise also uses noncompliance information as part of a feedback loop to the standards development process. This allows enhanced reliability standards through appropriate information flows from compliance monitoring and enforcement to the standards drafting process and other NERC programs. NERC regularly provides analysis and lessons learned from noncompliance information to industry stakeholders and the public As required by 215(e)(6) of the Federal Power Act and the Commission s regulations at 18 C.F.R. 39.7(g), the Sanction Guidelines, Appendix 4B to the NERC Rules of Procedure, provide that penalties and sanctions imposed for the violation of a Reliability Standard shall bear a reasonable relation to the seriousness of the violation while also reflecting consideration of the other factors specified in the Sanction Guidelines. The Sanction Guidelines are available on NERC s website. 18 The NERC Rules of Procedure 19 Posted compliance exceptions, Spreadsheet Notices of Penalty, and Full Notices of Penalty 20 Quarterly enforcement program 21 Quarterly compliance reports 40

44 Section A 2018 Business Plan and Budget Program Area and Department Detail Stakeholder Engagement and Benefit Over the past few years, NERC and the Regional Entities have made substantial progress in reducing the number of instances of noncompliance remaining to be evaluated and processed. The ERO Enterprise has held registered entities accountable for instances of noncompliance that posed a risk to the reliability of the BPS while ensuring that enforcement actions are timely and transparent. NERC promotes a culture of reliability excellence by examining registered entities internal compliance programs and considering them as mitigating factors in penalty determinations. Processing Efficiencies In an effort to improve the efficiency of enforcement processing throughout the ERO Enterprise, NERC developed a series of key enforcement processing metrics, which are tracked and analyzed throughout the year. Enforcement s 2016 goal to have more than 70 percent of issues of noncompliance be self-identified was met in The self-assessment and identification of noncompliance metric is used to compare the number of noncompliance discovered internally versus externally to promote self assessment and internal identification of noncompliance. For self identification of noncompliance in 2016, the threshold is 70 percent and the target is 75 percent. Enforcement met the threshold and target for this goal, closing the year at an 87 percent self-identification rate. The ERO Enterprise has continued to promote timely mitigation of noncompliance with over 99 percent of noncompliance discovered before 2013 having completed Mitigation Plans or mitigating activities, reducing risk to the BPS. The ERO Enterprise successfully met its mitigation targets for noncompliance discovered in 2014 and 2015 by ensuring at least 90 percent of noncompliance discovered in 2014 and 75 percent of noncompliance discovered in 2015 have been mitigated. Significantly, these target goals were both exceeded, with almost 99 percent of 2014 noncompliance and 90 percent of 2015 noncompliance being mitigated. Enforcement also met its goal of having 100 percent of NOPs approved by FERC. The ongoing use of CEs throughout the ERO Enterprise, combined with the influx of noncompliance discovered in the second half of 2016, has contributed to the average age of noncompliance in Q dropping to less than 8 months. The average age has not been this low since Typically, noncompliance has a relatively consistent average age in the ERO Enterprise inventory of approximately 10 to 11 months. Further, eighty-one percent of the ERO Enterprise noncompliance inventory is less than one year old, and only seven percent is over two years old. Finally, at the beginning of 2016, there were 368 federal entity violations that were on hold pending the result of a case before the DC Circuit Court of Appeals. Federal violations have been prioritized in 2016, and there are only 17 still needing to be processed, less than five percent of the initial total. Continued Outreach Efforts in 2017 and Beyond In 2017, NERC and the Regional Entities will continue to conduct outreach activities that focus on selflogging, compliance exceptions, and risk assessment of noncompliance. NERC plans to use existing industry events, such as the Standards and Compliance workshops and industry webinars, to provide information on compliance enforcement activities. 22 Self-identification includes noncompliance discovered through Self-Reports, Self-Certifications, and Periodic Data Reporting. The percentage does not include self-identification before a Compliance Audit or Spot Check. 41

45 Section A 2018 Business Plan and Budget Program Area and Department Detail NERC Oversight of Risk-Based CMEP Implementation For 2017, ensuring the successful implementation of NERC s risk-based CMEP remains the priority of Compliance Enforcement s oversight plan. As part of that oversight and in addition to offering regular feedback to the Regional Entities, NERC will continue to identify areas for improvement or promoting consistency through training, guidance, or adjustment the following year. NERC also produces an ERO Enterprise CMEP annual report, which includes an assessment of the risk-based CMEP implementation. NERC expects to publish that report during Q NERC performs oversight of the Regional Entities enforcement programs primarily through the review of the processes, supporting evidence, and other information provided by the Regional Entities over the course of focused engagements of program areas that are scheduled throughout the year. NERC communicates the recommendations and findings to the Regional Entities to help the ERO Enterprise develop responsive strategies and solutions to potential issues and ensure uniform and consistent implementation of the CMEP. Such recommendations and findings also help identify priority areas for training of ERO Enterprise staff during the year. Other Key Enforcement Efforts Underway Regional Entity Training NERC Enforcement will provide training to Regional Entity staff on the most important elements of riskbased enforcement, including risk assessment of noncompliance and the determination of appropriate penalties and sanctions for noncompliance. NERC is developing this training based on observations from its oversight activities of Regional Entity settlement agreements, as well as the process reviews described above Goals and Deliverables Specific 2018 objectives for the Compliance Enforcement department include: Continuing to refine and improve the risk-based CMEP processes; Continuing to implement in a transparent manner an ERO Enterprise enforcement philosophy that is risk-focused and drives desired behaviors by registered entities; Expanding the feedback loop of information from Enforcement to Standards and other program areas; and Working closely with NERC s Compliance Assurance and Information Technology departments, as well as staff in the Regional Entities, regarding the evaluation of improvements in the existing compliance, reporting, analysis tracking system, and other compliance tools to support risk-based activities. Resource Requirements Personnel The 0.94 reduction in FTEs is the result of resource allocations that began in 2016 and will continue throughout 2017 in an attempt to realign staff with current needs. Contractor Expenses No Consultant and Contractor expenses are budgeted in Compliance Enforcement in 2018, which is consistent with However, the IT budget includes funding for the maintenance, evaluation, and development of enterprise tools supporting technical feasibility exceptions, registration, and enforcement activities. 42

46 Section A 2018 Business Plan and Budget Program Area and Department Detail Statement of Activities and Fixed Assets Expenditures 2017 Budget & Projection, and 2018 Budget COMPLIANCE ENFORCEMENT Variance Variance 2017 Projection 2018 Budget v 2017 Budget 2018 v 2018 Budget Budget Projection Over(Under) Budget Over(Under) Funding ERO Funding NERC Assessments $ 5,677,854 $ 5,677,854 $ 0 $ 6,760,339 $ 1,082,484 Assessment Stabilization Reserve - Penalties 122, , (122,465) Total NERC Funding $ 5,800,319 $ 5,800,319 $ 0 $ 6,760,339 $ 960,019 Third-Party Funding $ - $ - $ - $ - $ - Testing Fees Services & Software Workshops Interest 327 7,690 7,363 6,294 5,967 Miscellaneous Total Funding $ 5,800,647 $ 5,808,009 $ 7,363 $ 6,766,633 $ 965,986 Expenses Personnel Expenses Salaries $ 1,790,859 $ 1,778,953 $ (11,906) $ 1,797,735 $ 6,876 Payroll Taxes 117, ,979 (3,227) 115,916 (1,290) Benefits 184, ,471 (4,635) 168,766 (15,341) Retirement Costs 198, ,259 (5,435) 200,403 1,708 Total Personnel Expenses $ 2,290,865 $ 2,265,662 $ (25,203) $ 2,282,819 $ (8,046) Meeting Expenses Meetings $ 2,500 $ 2,500 $ - $ 2,000 $ (500) Travel 56,736 54,000 (2,737) 47,500 (9,236) Conference Calls (366) - (366) Total Meeting Expenses $ 59,602 $ 56,500 $ (3,103) $ 49,500 $ (10,102) Operating Expenses Consultants & Contracts $ - $ - $ - $ - $ - Office Rent Office Costs 20,379 20, ,160 (1,220) Professional Services Miscellaneous 500 1, Depreciation - 26,254 26, , ,014 Total Operating Expenses $ 20,879 $ 47,633 $ 26,753 $ 124,674 $ 103,794 Total Direct Expenses $ 2,371,347 $ 2,369,795 $ (1,552) $ 2,456,993 $ 85,646 Indirect Expenses $ 3,206,790 $ 3,252,677 $ 45,887 $ 2,866,736 $ (340,053) Other Non-Operating Expenses $ - $ - $ - $ - $ - Total Expenses (A) $ 5,578,137 $ 5,622,472 $ 44,335 $ 5,323,729 $ (254,408) Change in Assets $ 222,510 $ 185,538 $ (36,972) $ 1,442,904 $ 1,220,394 Fixed Assets Depreciation $ - $ (26,254) $ (26,254) $ (105,014) $ (105,014) Computer & Software CapEx ,500,000 1,500,000 Furniture & Fixtures CapEx Equipment CapEx Leasehold Improvements Allocation of Fixed Assets 222,510 92,498 (130,012) 47,918 (174,592) Inc(Dec) in Fixed Assets (B) $ 222,510 $ 66,245 $ (156,265) $ 1,442,904 $ 1,220,394 TOTAL BUDGET (=A+B) $ 5,800,647 $ 5,688,716 $ (111,930) $ 6,766,633 $ 965,986 FTEs (0.94) 43

47 Section A 2018 Business Plan and Budget Program Area and Department Detail Reliability Assessment and System Analysis Reliability Assessment and System Analysis (in whole dollars) 2017 Budget 2018 Budget Increase (Decrease) Total FTEs Direct Expenses $ 3,986,965 $ 4,221,486 $ 234,520 Indirect Expenses 3,435,846 3,307,773 (128,073) Other Non-Operating Expenses Inc(Dec) in Fixed Assets 112,782 (95,482) (208,264) TOTAL BUDGET $ 7,535,594 $ 7,433,777 $ (101,817) Background and Scope The Reliability Assessment and System Analysis (RASA) department carries out the ERO s statutory responsibility to conduct assessments of the reliability and adequacy of the BES. These assessments are used to provide insight and guidance about reliability risks. These insights provide a foundation for the development of new reliability standards or modifications to mandatory reliability standards, or other initiatives, such as guidelines, alert(s), webinars, etc., all focused on enhancing overall reliability. The majority of the activities in the RASA department directly address the risk priorities established by the RISC. In particular, the risks pertaining to changing resources and planning noted in the 2016 RISC report are of particular importance to the assessment and analysis work being performed in RASA. NERC staff works closely with stakeholders on creating assessment development schedules, including schedules with adequate stakeholder review at every level. All NERC reliability assessments have a sponsoring technical committee, subcommittee, or other subgroup. The Long-Term and Seasonal assessments are conducted by the Reliability Assessment Subcommittee, and ultimately endorsed by the Planning Committee. Special Assessments often require a separate and specialized task force or advisory group to help construct, conduct, and produce special topic assessments such as the Clean Power Plan assessments, Natural Gas interdependency assessment, and distributed energy report. The department focuses on developing a technical framework and understanding the emerging reliability risks facing the industry. It also provides guidance and insights to stakeholders across North America. The department relies on its own engineering and analysis expertise, as well as Regional Entity and stakeholder resources. RASA is responsible for: Independent reliability assessments on the overall reliability and adequacy of the BES and associated emerging reliability risks that could impact the short-, mid- and the long-term (e.g., 10- year) planning horizons, and other reliability issues requiring an in-depth analysis. Support for the development and improvement of long-term sustainable interconnection-based power flow, dynamic, and load models that exhibit the accuracy and fidelity reflecting actual BES reliability performance and dynamic conditions. Interconnection-wide analysis of steady-state and dynamic conditions, including frequency, Essential Reliability Services, stability, short circuit radio, and oscillatory behavior aspects. Advancement of industry and the ERO s understanding of power system characteristics and behaviors by gathering larger Phasor Measurement Unit (PMU) datasets for advanced data analytics and modeling improvements. 44

48 Section A 2018 Business Plan and Budget Program Area and Department Detail Assurance oversight that the BES electrical elements necessary for its reliable operation are identified, requiring the elements to follow the appropriate NERC Reliability Standards. Establishment of reliability leadership and consistent, technically sound guidance and recommendations that position industry and policy makers to enhance reliability through effective outreach and communications. Stakeholder Engagement and Benefit RASA works with industry leaders to create a reliability strategy that is relevant, timely, and effective to address the most important reliability risks. This effort includes reviewing and addressing key priority risks identified by NERC s RISC; synthesizing key information identified through analysis and assessment efforts; extracting and prioritizing the associated reliability risks; sharing and integrating risk analysis insights across the ERO Enterprise; and translating that knowledge into actionable guidance and recommendations for NERC management, the Board, and entities, along with state, federal, and provincial policy makers. In addition, the ERO monitors the ongoing and historic reliability performance of the BES through data gathered to analyze historic trends. The ERO provides reports and recommendations regarding the anticipated conditions that could impact the reliability, security, and stability of the BPS to the industry, Regional Entities, regulatory entities, and other designated entities Enhancements Enhancements in the 2018 BP&B are a reflection of the strategic goals and objectives identified in the ERO Enterprise Strategic Plan and Metrics The following enhancements are attributable to Strategic Goal 1 and the objectives and valued outcomes noted within Strategic Goal 1: Interconnection-wide analysis of steady-state and dynamic conditions, including frequency, Essential Reliability Services, stability, Short Circuit Ratio and oscillatory behavior aspects. Perform model validations at the interconnection level and compare with internal transmission owner models. (Short circuit model validation) The following enhancements are attributable to Strategic Goal 4 and the objectives and valued outcomes noted within Strategic Goal 4: Improve resource adequacy assessments with increased probabilistic and risk analysis; Conduct interconnection-wide analysis to support NERC s reliability assessments and improve industry planning; Increase technical analysis and assessment focus on natural gas, wind, and solar resource and fuel availability; Develop technical references and guidelines that advance and improve reliability using new technologies; and Develop quality/fidelity assessments of interconnection models. 45

49 Section A 2018 Business Plan and Budget Program Area and Department Detail The following enhancement is attributable to Strategic Goal 5 and the objectives and valued outcomes noted within Strategic Goal 5: Enhance and implement documented oversight plans for Regional Entity delegated functions. Key RASA Efforts Underway RASA focuses its efforts in the following key areas: Reliability Assessment Reliability assessments serve to evaluate the expected reliability of the BES through extensive deterministic and probabilistic analyses to identify potential reliability risks and potential mitigation approaches. These reviews include both evaluations at the edge of the planning horizon, as well as assessments of the anticipated performance during the short-term (12- to 18-month outlook). These analyses involved planned and anticipated changes to generation resources, transmission infrastructure, and load behavior compared to base-line needs of the system to remain reliable and formulate recommendations and related guidance. This assessment is often by completed by examining special scenarios and unique situations within the BES. These analyses provide a technical platform for important policy discussions on challenges facing the interconnected BES, as well as focused recommendations on mitigation to improve overall reliability or lessen reliability risks. By identifying and quantifying emerging reliability issues, NERC is able to provide risk-informed recommendations and support a learning environment for industry to address emerging risks and pursue improved reliability performance. These efforts are expected to expand to assess the impacts on reliability from the changing resource mix, reliability behavior of resources, distributed energy resources, and loads. Many resource additions are asynchronous and energy-limited, requiring assessment of a substantial number of scenarios rather than just seasonal peak conditions. Reliability assessments must therefore include a greater focus on probabilistic approaches, assessing the sufficiency of essential reliability services as well as focusing seasonal assessments on short-term horizons to encompass more than peak condition reserve margin analyses. Key assessments include: Long-Term Reliability Assessment (supplemented by the Probabilistic Assessment) Summer and Winter Reliability Assessments (condensed report) Short-Term and Special Reliability Assessments a. Between one and four short-term reliability assessments are expected, driven by the need to assess emerging short-term risks to reliability b. Special Assessments are selected based on high-priority/high-risk issues that require an independent assessment from the ERO. A significant ongoing effort anticipated to involve RASA, Regional Entity staff, and stakeholders focuses on the continued development of effective Essential Reliability Services. These efforts are expected to lead to a broad set of recommendations that will culminate with defined elements, an evaluation of initial metrics and data compilation of actual performance, and refinement about the ongoing assessment of Essential Reliability Services measures. System Analysis Understanding the technical behavior of the North American grid is the foundation for identifying crucial aspects of performance that are important for sustaining overall reliability. NERC s understanding of grid 46

50 Section A 2018 Business Plan and Budget Program Area and Department Detail behavior is achieved through a comprehensive evaluation of system behavior through constant observation and study, analytic simulations, and forensic analysis of system disturbances. Methodically comparing the simulation results of powerflow and system dynamic performance to actual system behavior improves models critical for industry use to simulate system conditions as well as enables RASA to gain insights to enhance predictive system analysis. The ERO Enterprise RASA team also supports the following objectives: Continue leading and improving NERC s analytical capabilities to address a broad range of engineering topics, Support NERC Reliability Standards development with subject matter expertise, Support and lead technical analysis of emerging risks requiring advanced analytics and interconnection-wide assessment, Detailed forensic analysis of significant system disturbances Key focus areas: PMU Measurement, use, and analysis improvements o o o Synchrophasor technology Power plant model verification Oscillation analysis Frequency Response Analysis, Interconnection Frequency Response Obligation Analysis, and forward-looking reliability assessment Interconnection-Wide system inertia study Interconnection-Wide short circuit ratio assessment Interconnection-Wide Model Building Designation and Criteria administration Interconnection-Wide model validation Improving model quality and fidelity Analysis of TPL Footnote 12 Load and distributed energy resource modeling Event analysis simulation and forensic analysis of major events Reliability Standards support BES Exception and Self-Determined Notification Processing Further, RASA will continue to work closely with other organizations, including but not limited to the Electric Power Research Institute (EPRI), the Department of Energy (DOE), the Institute of Electrical and Electronic Engineers (IEEE), the Institute of Nuclear Power Operations (INPO), the North American Transmission Forum (NATF), the North American Generation Forum (NAGF), and the Canadian Electricity Association (CEA). RASA collaborates with these groups on a number of fronts, including geomagnetic disturbance (GMD), vegetation management, and variable generation integration. RASA will continue working with the Interstate Natural Gas Association of America (INGAA) and the Natural Gas Supply Association (NGSA) regarding studies pertaining to the interdependency of gas and electric systems. 47

51 2018 Goals and Deliverables Section A 2018 Business Plan and Budget Program Area and Department Detail In 2018, RASA will seek to achieve several specific goals and objectives as part of the strategic focus of the ERO Enterprise (Strategic Goals 1, 4, and 5): Pioneer implementation of advanced reliability assessment and system analysis methods to address the changing nature of the grid. Issue reliability assessment reports, guidelines, and recommendations to address high priority evolving performance trends and address emerging risks to reliability. Expand the use of probabilistic assessment tools across the ERO and gain consistency in approach Special assessments on identified high-priority risks (from RISC prioritization and recommendations) 23 o o o o Changing resource mix and maintaining Essential Reliability Services Increased penetration of Distributed Energy Resources Increasing dependency on generation fueled by natural gas Broaden understanding of inter-area and local system oscillations in all interconnections and their potential impact on interconnection reliability. As part of its oversight of the Regional Entities, build and sustain an Enterprise RAPA team (ERO-RAPA) that encompasses the consistent development and implementation of riskinformed approaches and structured methods to identify and address reliability risks. Develop technical analyses in key reliability areas, resulting in technically accurate and comprehensive reports addressing areas of concern (e.g., Frequency Response, Short Circuit Strength, Inter-area Oscillation, Distributed Energy Resource (DER) and etc.). The purpose of these technical analyses are to understand and evaluate the Bulk Power System (BPS) characteristics, behavior and performance due to the changing resource mix and integration of new technology. It is also intended to provide oversight, guidance, direction, and technical expertise to address key planning related issues and interconnection-wide concerns. Provide technical expertise, research and feedback to the industry. Provide foundational technical efforts that support the key reliability planning-related standards development. In addition to providing feedback, NERC will also solicit industry s help by utilizing resources and leveraging any research that has been done by the industry. Continue to explore the use of state of the art software to conduct power system analysis. Enhance the usage of real-time tools used by the industry to sharpen and fine tune our models as the system evolves with the integration of new technology. Support NERC Reliability Standard development by providing subject matter expertise. Provide support and leadership to (1) the Planning Committee and (2) standing committees subcommittees, working groups, and task forces serving the standing committees. Support the development of technical reference documents and Reliability Guidelines with support of the PC leadership and established in the annual PC work plan As necessary, support major event investigations, analyses, and reporting of findings, recommendations, and lessons learned to improve reliability. 23 RISC Recommendations to the NERC Board of Trustees 48

52 Section A 2018 Business Plan and Budget Program Area and Department Detail Provide feedback to interconnection-wide model-building groups on improvements to system model quality and fidelity. Assist in the development of approaches to registration and provide input to NERC staff in support of the development of CMEP risk elements, as well as support and lead the BES Definition Exception Process. Resource Requirements Personnel No additional personnel were allocated to RASA in Contractor Expenses The total contractor and consultant expenses for the RASA department remain unchanged from 2017 to 2018 at $525k. Further information is provided in Exhibit C Contractor and Consulting Costs. 49

53 Section A 2018 Business Plan and Budget Program Area and Department Detail Statement of Activities and Fixed Assets Expenditures 2017 Budget & Projection, and 2018 Budget RELIABILITY ASSESSMENT and SYSTEM ANALYSIS Variance Variance 2017 Projection 2018 Budget v 2017 Budget 2018 v 2018 Budget Budget Projection Over(Under) Budget Over(Under) Funding ERO Funding NERC Assessments $ 7,339,030 $ 7,339,030 $ 0 $ 7,401,514 $ 62,484 Assessment Stabilization Reserve - Penalties 131, ,213 (0) - (131,213) Total NERC Funding $ 7,470,243 $ 7,470,243 $ 0 $ 7,401,514 $ (68,729) Third-Party Funding $ - $ - $ - $ - $ - Testing Fees Services & Software 50,000 - (50,000) - (50,000) Workshops 15,000 15,000-25,000 10,000 Interest 351 7,027 6,676 7,263 6,912 Miscellaneous Total Funding $ 7,535,594 $ 7,492,270 $ (43,324) $ 7,433,777 $ (101,817) Expenses Personnel Expenses Salaries $ 2,247,826 $ 2,130,138 $ (117,688) $ 2,291,479 $ 43,653 Payroll Taxes 142, ,723 (8,196) 143, Benefits 263, ,290 (1,941) 299,451 36,221 Retirement Costs 246, ,963 (11,647) 252,369 5,759 Total Personnel Expenses $ 2,900,585 $ 2,761,113 $ (139,471) $ 2,986,326 $ 85,741 Meeting Expenses Meetings $ 74,000 $ 74,000 $ (0) $ 121,000 $ 47,000 Travel 208, ,000 10, ,000 41,662 Conference Calls 5,270 3,000 (2,271) - (5,270) Total Meeting Expenses $ 287,608 $ 295,999 $ 8,391 $ 371,000 $ 83,392 Operating Expenses Consultants & Contracts $ 525,000 $ 503,020 $ (21,980) $ 525,000 $ - Office Rent Office Costs 147, , ,889 40,238 Professional Services Miscellaneous Depreciation 125, , ,771 25,150 Total Operating Expenses $ 798,773 $ 776,793 $ (21,980) $ 864,160 $ 65,387 Total Direct Expenses $ 3,986,965 $ 3,833,906 $ (153,060) $ 4,221,486 $ 234,520 Indirect Expenses $ 3,435,846 $ 3,485,011 $ 49,165 $ 3,307,773 $ (128,073) Other Non-Operating Expenses $ - $ - $ - $ - $ - Total Expenses (A) $ 7,422,812 $ 7,318,917 $ (103,895) $ 7,529,258 $ 106,447 Change in Assets $ 112,782 $ 173,353 $ 60,571 $ (95,482) $ (208,264) Fixed Assets Depreciation $ (125,621) $ (125,621) $ (0) $ (150,771) $ (25,150) Computer & Software CapEx - 31,145 31, Furniture & Fixtures CapEx Equipment CapEx Leasehold Improvements Allocation of Fixed Assets 238,403 99,105 (139,298) 55,289 (183,114) Inc(Dec) in Fixed Assets (B) $ 112,782 $ 4,629 $ (108,153) $ (95,482) $ (208,264) TOTAL BUDGET (=A+B) $ 7,535,594 $ 7,323,546 $ (212,048) $ 7,433,777 $ (101,817) FTEs (1.43)

54 Section A 2018 Business Plan and Budget Program Area and Department Detail Reliability Risk Management NERC s Reliability Risk Management (RRM) group carries out the ERO s statutory responsibility to perform assessments (real time or near real time continual awareness, detailed analysis of significant events, and longer-term broad performance assessments) of the reliability and adequacy of the BES, including identifying potential issues of concern relating to system, equipment, entity, and human performance that may indicate the need to develop and implement targeted interventions. RRM has three departments: Situation Awareness (also referred to as Bulk Power System Awareness), Event Analysis, and Performance Analysis. These departments are responsible for six primary functions: (1) BES awareness, (2) event analysis and determination of root and contributing causes, (3) assessment of human performance challenges that affect BES reliability and identification of improvement opportunities, (4) continent-wide analysis and reporting of BES performance, (5) support of the NERC Operating Committee, and (6) support of the NERC CIPC. RRM s functions and resources are directly focused on proactive awareness of BES conditions and all events over a threshold of certain risk or impact. Through awareness and continuous assessment, RRM identifies potential reliability risks to the BES. RRM analyzes events in detail, addresses the most significant risks to BES reliability, and ensures that industry is well informed of system events, emerging trends, risk analysis, and lessons learned. Through performing these functions, RRM provides data and analysis to inform the other aspects of NERC s statutory functions. The group also provides strategic direction for using risk-based concepts in planning and executing its responsibilities. Situation Awareness Situation Awareness (in whole dollars) 2017 Budget 2018 Budget Increase (Decrease) Total FTEs Direct Expenses $ 2,570,828 $ 2,582,781 $ 11,952 Indirect Expenses 1,374,338 1,323,109 (51,229) Other Non-Operating Expenses Inc(Dec) in Fixed Assets 87,695 19,556 (68,138) TOTAL BUDGET $ 4,032,862 $ 3,925,446 $ (107,415) Background and Scope NERC s Situation Awareness department and the eight Regional Entities monitor BES conditions, significant occurrences and emerging risks, and threats across the 14 Reliability Coordinator regions in North America to maintain an understanding of conditions and situations that could impact the bulk electric system s reliable operation. This group also supports the development and publication of Alerts and awareness products and facilitates information sharing among industry, Regions, and the government during crisis situations and major system disturbances. The process for understanding the potential threats or vulnerabilities to the reliability of the BPS starts with understanding occurrences and events in the context in which they occur. Stakeholder Engagement and Benefit BES conditions continually change and provide recognizable signatures through automated tools, mandatory reports and voluntary information sharing, and third-party publicly available sources. The significant majority of these signatures represents conditions and occurrences that have little or no reliability impact, either positive or adverse, on the BES. However, being cognizant of the short-term condition of the BES and the signatures associated with the entire range of reliability performance helps 51

55 Section A 2018 Business Plan and Budget Program Area and Department Detail the ERO identify significant occurrences and events more accurately and efficiently. Registered entities continue to robustly share information and collaborate with the ERO in an effort to maintain and improve the overall reliability of the grid. Key Efforts Underway Several reliability-related situation awareness and monitoring tools will undergo enhancement, replacement, streamlining, or modification. The following tools are being focused on during 2016: (1) operation and maintenance of Situation Awareness for NERC, FERC, and Regions, Version 2 (SAFNRv2) software application used for monitoring, to include preparation for a new RFP process in late 2016 to enhance the tool from its current state with no changes to the data used; (2) operation and maintenance of the current secure NERC Alerts tool while planning for a streamlined NERC Alert process and platform appropriately integrated with related ongoing NERC, E-ISAC and ERO Enterprise IT initiatives; (3) refresh of the Reliability Coordinator Information System (RCIS) legacy application for operability and maintainability reasons, with no significant changes to functionality; and (4) continuing to set the conditions to bring limited streaming Synchrophasor data into NERC for wide-area situational awareness and event triage applications Goals and Deliverables In 2017, the Situation Awareness department will seek to accomplish the following specific goals and deliverables: Ensure that the ERO is aware of all BES events above a threshold of impact; Enable the sharing of information and data to facilitate wide-area situational awareness; During crisis situations, facilitate the exchange of information among industry, Regions, and the U.S. and Canadian governments; Keep industry informed of emerging reliability threats and risks to the BES, including any expected actions; Conduct the annual NERC Monitoring and Situational Awareness Conference and Human Performance Conference; Administer the NERC Alerts process as specified in ROP 810 to issue Advisory (Level 1) Alerts on significant and emerging reliability- and security-related topics as needed, and facilitate the tracking of actions specified in Recommendation (Level 2) and Essential Action (Level 3) Alerts; and Perform oversight, as per the Situation Awareness Oversight Plan, of the activities and performances of the Regional staffs. The department uses the following major reliability-related tools to support department activities: Resource Adequacy (ACE Frequency) Tool This software application provides continuous monitoring of key resource adequacy performance metrics, including pre-established thresholds and limits defined in standards. It alerts Reliability Coordinators and resource subcommittees to conditions that could result in critical inadequacies, such as major tie errors, inaccurate load forecasts, and inadequate frequency response. 52

56 Section A 2018 Business Plan and Budget Program Area and Department Detail Inadvertent Interchange This tool facilitates the entering of monthly scheduling data and submittal of monthly inadvertent performance standards reports to NERC. It also assists in the monitoring and resolution of reliability issues originated by inadvertent interchange imbalances. Frequency Monitoring and Analysis Tool This tool detects frequency events and captures key frequency response information for each interconnection. Intelligent Alarms Tool This tool detects short-term and long-term frequency deviations using data transmitted to NERC by the BAs. When coupled with the FNet 24 and Frequency Monitoring and Analysis tools, this tool allows immediate differentiation of the cause of a frequency deviation a generator trip or a scheduling error. Genscape The PowerIQ and PowerRT tools provide more detailed insight into current-day conditions impacting BPS conditions in both normal operations and stressed conditions. Resource Requirements Personnel There is no change in personnel from the 2017 to 2018 budget. Contractor Expenses The overall funding of approximately $1.3M for contractors and consultants (which includes the cost of the tools set forth above) to support the department in 2018 is consistent with Further information is provided in Exhibit C Contractor and Consulting Costs. 24 FNet Operated by the Power Information Technology Laboratory at the University of Tennessee, FNet is a low-cost, quickly deployable global positioning system (GPS)-synchronized wide-area frequency measurement network. High dynamic accuracy Frequency Disturbance Recorders are used to measure the frequency, phase angle, and voltage of the power system at ordinary 120 V outlets. The measurement data are continuously transmitted via the Internet to the FNet servers hosted at the University of Tennessee and Virginia Tech. 53

57 Section A 2018 Business Plan and Budget Program Area and Department Detail Statement of Activities and Fixed Assets Expenditures 2017 Budget & Projection, and 2018 Budget SITUATION AWARENESS Variance Variance 2017 Projection 2018 Budget v 2017 Budget 2018 v 2018 Budget Budget Projection Over(Under) Budget Over(Under) Funding ERO Funding NERC Assessments $ 3,980,236 $ 3,980,236 $ (0) $ 3,922,541 $ (57,695) Assessment Stabilization Reserve - Penalties 52,485 52, (52,485) Total NERC Funding $ 4,032,721 $ 4,032,721 $ (0) $ 3,922,541 $ (110,180) Third-Party Funding $ - $ - $ - $ - $ - Testing Fees Services & Software Workshops Interest 140 3,328 3,188 2,905 2,765 Miscellaneous Total Funding $ 4,032,862 $ 4,036,049 $ 3,188 $ 3,925,446 $ (107,415) Expenses Personnel Expenses Salaries $ 873,869 $ 865,196 $ (8,673) $ 902,263 $ 28,394 Payroll Taxes 58,749 57,013 (1,737) 59,759 1,009 Benefits 156, ,497 (22,832) 144,560 (11,769) Retirement Costs 96,159 96, ,748 4,589 Total Personnel Expenses $ 1,185,105 $ 1,151,895 $ (33,210) $ 1,207,329 $ 22,224 Meeting Expenses Meetings $ 6,500 $ 6,500 $ (0) $ 2,000 $ (4,500) Travel 33,005 33,003 (2) 33,000 (5) Conference Calls (105) - (305) Total Meeting Expenses $ 39,810 $ 39,703 $ (107) $ 35,000 $ (4,810) Operating Expenses Consultants & Contracts $ 1,295,850 $ 1,295,850 $ 0 $ 1,295,495 $ (355) Office Rent Office Costs 41,897 41, ,897 (0) Professional Services Miscellaneous Depreciation 7,667 7, ,559 (5,107) Total Operating Expenses $ 1,345,914 $ 1,346,234 $ 321 $ 1,340,451 $ (5,462) Total Direct Expenses $ 2,570,828 $ 2,537,832 $ (32,996) $ 2,582,781 $ 11,952 Indirect Expenses $ 1,374,338 $ 1,394,004 $ 19,666 $ 1,323,109 $ (51,229) Other Non-Operating Expenses $ - $ - $ - $ - $ - Total Expenses (A) $ 3,945,167 $ 3,931,837 $ (13,330) $ 3,905,890 $ (39,277) Change in Assets $ 87,695 $ 104,212 $ 16,518 $ 19,556 $ (68,138) Fixed Assets Depreciation $ (7,667) $ (7,987) $ (320) $ (2,559) $ 5,107 Computer & Software CapEx Furniture & Fixtures CapEx Equipment CapEx Leasehold Improvements Allocation of Fixed Assets 95,361 39,642 (55,719) 22,116 (73,246) Inc(Dec) in Fixed Assets (B) $ 87,695 $ 31,655 $ (56,040) $ 19,556 $ (68,138) TOTAL BUDGET (=A+B) $ 4,032,862 $ 3,963,492 $ (69,370) $ 3,925,446 $ (107,415) FTEs

58 Event Analysis Section A 2018 Business Plan and Budget Program Area and Department Detail Event Analysis (in whole dollars) 2017 Budget 2018 Budget Increase (Decrease) Total FTEs Direct Expenses $ 2,592,388 $ 2,686,324 $ 93,935 Indirect Expenses 2,748,677 2,646,218 (102,459) Other Non-Operating Expenses Inc(Dec) in Fixed Assets 105,141 (40,711) (145,852) TOTAL BUDGET $ 5,446,206 $ 5,291,830 $ (154,376) Background and Scope The Event Analysis department performs assessments of the reliability and adequacy of the BES. This includes identifying potential issues of concern related to system, equipment, entity, and human performance that may indicate a need to develop remediation strategies, action plans, or data used to revise or retire reliability standards or consider new reliability standards. The department analyzes and determines the cause of the events, promptly ensures tracking of corrective actions to prevent recurrence, and provides lessons learned to the industry. Event Analysis ensures that reporting and analysis are consistent to allow wide-area assessment of trends and risks. The department analyzes all reportable events for sequence of events, root cause, risk to reliability, and mitigation and keeps the industry well informed of system events, emerging trends, risk analysis, lessons learned, and expected actions. Additional resources within this department focus on identifying human-error risks and those precursor factors that allow human error to impact system reliability. The department educates industry regarding risks, precursors, and mitigation methods. Resources also support compliance and standards training initiatives and trending and analysis to identify emerging reliability risks to the BES. These efforts are conducted in collaboration with industry human performance projects, including WECC s Human Performance Working Group, the NERC Operating Committee s Event Analysis Subcommittee, and others. Stakeholder Engagement and Benefit The Event Analysis department coordinates event analyses to support the use of collective resources, consistency in analysis, and timely delivery of event analysis reports. 25 The ERO disseminates to the electric industry lessons learned and other useful information obtained from or as a result of event analysis. The Event Analysis team conducts in-depth analyses of approximately 150 events per year on average. In 2014, the team also conducted calls facilitated by the Regional Entities with over 140 registered entities to discuss in detail and finalize root and contributing causes for the categorized events analyzed. Major analysis to date includes continuing assessment of Energy Management System (EMS) outages, continued collaboration with RASA on frequency response performance, analyses of substation equipment failure events and protective relay trends including ground overcurrent relay misoperations, relay communication system failures, and the importance of commissioning testing. 25 The core process for Event Analysis is outlined in the approved process: Electric Reliability Organization Event Analysis Process - Version 3 (January 2016). 55

59 Section A 2018 Business Plan and Budget Program Area and Department Detail Collaboration with the Trade Associations and Forums The activities of the NATF, the NAGF, trade associations, and other industry groups are expected to compliment ERO Enterprise activities and limit the need to add incremental resources to the NERC and Regional Entity BP&Bs that might otherwise be required in the absence of these forums. NATF has been invited to participate in several reliability initiatives that are expected to continue into 2018, including protection systems misoperations reduction, physical security, various activities related to reliability assurance initiatives, improvement of modeling practices, and complementary efforts on addressing the GMD challenges Goals and Deliverables In 2018, the Event Analysis department will seek to accomplish several specific goals and objectives as part of the strategic focus of the ERO Enterprise: Work with the Regional Entities to obtain and review information from registered entities on qualifying events and disturbances to advance awareness of events above a threshold level; facilitate analysis of root and contributing causes, risks to reliability, wide-area assessments, and remediation efforts; and disseminate information regarding events in a timely manner; Ensure that all reportable events are analyzed for sequence of events, root cause, risk to reliability, and mitigation; Continue to refine risk-based methods to support better identification of reliability risks, including the use of more sophisticated cause codes for analysis; Conduct training (webinars, workshops, and conference support) to inform industry and the ERO of lessons learned, root cause analysis, trends, human performance, and extreme weather preparedness and recommendations; Develop reliability recommendations and alerts as needed and track industry accountability for critical reliability recommendations; Ensure that industry is well informed of system events, emerging trends, risk analysis, lessons learned, and expected actions; Conduct major event analysis and reporting of major findings and recommendations that will improve reliability; and Perform oversight, as per the Event Analysis Oversight Plan, of the activities and performance of the Regional staffs. The Event Analysis department will also support several of the top-priority reliability risk projects during 2018 through 2019, as identified and described under the Performance Analysis department section of this document. Resource Requirements Personnel There is no change in personnel from the 2017 to 2018 budget. Contractor Expenses No funding is budgeted for contract and consultants in 2018, which is consistent with

60 Section A 2018 Business Plan and Budget Program Area and Department Detail Statement of Activities and Fixed Assets Expenditures 2017 Budget & Projection, and 2018 Budget EVENT ANALYSIS Variance Variance 2017 Projection 2018 Budget v 2017 Budget 2018 v 2018 Budget Budget Projection Over(Under) Budget Over(Under) Funding ERO Funding NERC Assessments $ 5,300,955 $ 5,300,955 $ 0 $ 5,246,020 $ (54,935) Assessment Stabilization Reserve - Penalties 104, , (104,970) Total NERC Funding $ 5,405,926 $ 5,405,926 $ 0 $ 5,246,020 $ (159,905) Third-Party Funding $ - $ - $ - $ - $ - Testing Fees Services & Software Workshops 40, ,300 75,300 40,000 (0) Interest 281 6,211 5,930 5,810 5,529 Miscellaneous Total Funding $ 5,446,206 $ 5,527,436 $ 81,230 $ 5,291,830 $ (154,376) Expenses Personnel Expenses Salaries $ 1,708,049 $ 1,729,383 $ 21,334 $ 1,788,781 $ 80,732 Payroll Taxes 108, ,135 1, ,619 1,880 Benefits 212, ,296 6, ,016 15,784 Retirement Costs 189, ,239 (6,157) 198,179 8,782 Total Personnel Expenses $ 2,218,416 $ 2,241,053 $ 22,637 $ 2,325,595 $ 107,178 Meeting Expenses Meetings $ 81,500 $ 170,000 $ 88,500 $ 81,500 $ (0) Travel 152, ,000 (2,487) 150,000 (2,487) Conference Calls 4,270 1,000 (3,270) - (4,270) Total Meeting Expenses $ 238,257 $ 321,000 $ 82,743 $ 231,500 $ (6,757) Operating Expenses Consultants & Contracts $ - $ - $ - $ - $ - Office Rent Office Costs 49,634 49,633 (0) 43,786 (5,848) Professional Services Miscellaneous Depreciation 85,582 85,582 (0) 84,943 (639) Total Operating Expenses $ 135,715 $ 135,715 $ (0) $ 129,229 $ (6,487) Total Direct Expenses $ 2,592,388 $ 2,697,768 $ 105,380 $ 2,686,324 $ 93,935 Indirect Expenses $ 2,748,677 $ 2,788,009 $ 39,332 $ 2,646,218 $ (102,459) Other Non-Operating Expenses $ - $ - $ - $ - $ - Total Expenses (A) $ 5,341,065 $ 5,485,777 $ 144,712 $ 5,332,542 $ (8,523) Change in Assets $ 105,141 $ 41,660 $ (63,481) $ (40,711) $ (145,852) Fixed Assets Depreciation $ (85,582) $ (85,582) $ 0 $ (84,943) $ 639 Computer & Software CapEx Furniture & Fixtures CapEx Equipment CapEx Leasehold Improvements Allocation of Fixed Assets 190,723 79,284 (111,439) 44,232 (146,491) Inc(Dec) in Fixed Assets (B) $ 105,141 $ (6,298) $ (111,439) $ (40,711) $ (145,852) TOTAL BUDGET (=A+B) $ 5,446,206 $ 5,479,479 $ 33,273 $ 5,291,830 $ (154,376) FTEs (0.18)

61 Performance Analysis Section A 2018 Business Plan and Budget Program Area and Department Detail Performance Analysis (in whole dollars) 2017 Budget 2018 Budget Increase (Decrease) Total FTEs Direct Expenses $ 2,459,356 $ 2,633,680 $ 174,325 Indirect Expenses 2,290,564 2,205,182 (85,382) Other Non-Operating Expenses Inc(Dec) in Fixed Assets 158,936 (107,139) (266,075) TOTAL BUDGET $ 4,908,855 $ 4,731,723 $ (177,133) Background and Scope The Performance Analysis department provides insight and guidance about reliability risks and areas of concern based on analysis of historic system performance. This includes identifying potential risks of concern related to system, equipment, entity, and organizational performance that may indicate a need to develop remediation strategies, action plans, new data collection or analysis tools, or data used to create, revise, or retire reliability standards or consider new reliability standards. The department focuses on developing a technical framework and understanding the reliability risks facing the industry. It is divided into Balancing and Frequency Control (B&FC) and Data Analytics (DA) groups. B&FC is focused on collecting and analyzing data primarily used to evaluate interconnection performance and to satisfy requirements of the BAL reliability standards. A significant workload is associated with implementation of the BAL standards, administering responsibilities assigned by each standard to the ERO. In addition to its legacy work with data collection and analysis, DA will continue the emergent 2017 trend of highly concentrated business support for IT projects including new data tools for its own use and assorted emergent projects to support FERC needs as well as those of other NERC groups. DA will continue developing more efficient, transparent, and wherever possible automated processes. Stakeholder Engagement and Benefit The ERO monitors the reliability performance of the BES in North America through data gathered to analyze historic trends. The ERO provides reports and recommendations regarding the anticipated conditions that could impact the reliability, security, and stability of the BPS to the industry, Regional Entities, regulatory entities, and other designated entities. The ERO works with industry leaders to create a reliability strategy that is relevant, timely, and effective at addressing the most important reliability risks. This effort includes Performance Analysis s contribution (both in data gathering and in statistical analysis of data, trends, and events) toward the ERO s understanding key information identified through analysis and assessment efforts; extracting and prioritizing the associated reliability risks from that information; sharing and integrating those risk analysis insights across the ERO Enterprise; and translating that knowledge into actionable guidance and recommendations for NERC management, the Board, and entities, and state, federal, and provincial policy makers. This offers stakeholders an open and transparent approach for the development of NERC s reliability strategy, ultimately ensuring the ERO is accountable to industry, regulators, and the public at large. 58

62 Section A 2018 Business Plan and Budget Program Area and Department Detail Key Efforts Underway Performance Analysis collects transmission outage, generator performance, demand response, and protection and control misoperation data in a common format using the various industry databases. This data is used to develop and report on grid metrics that analyze outage frequency, duration, causes, and many other factors related to transmission and generator performance, as well as automatic power system protection and control effectiveness. In addition to collecting simple equipment availability data, detailed information about individual outage events is collected that, when analyzed at the regional and NERC levels, provides data that may be used to improve BES reliability. The key trends, findings, and recommendations from Performance Analysis serve as technical input to the ERO s reliability standards and standards project prioritization, compliance process improvements, event analyses, reliability assessment, and critical infrastructure protection efforts. This analysis of BES performance provides an industry reference for historical BES reliability, but it also offers analytical insights that lead toward the prioritization of specific actionable risk control steps for industry. These analyses and results are summarized in the annual SOR Report, which provides guidance and recommendations for enhanced bulk system reliability. Performance Analysis has added GADS Wind Data to the data collected under Section 1600, requiring the development of a new software tool to enable this. By 2018, Performance Analysis will move to add solar data. Performance Analysis is working with Event Analysis to develop a link between their databases. Specific equipment outages will be linked to disturbance reports filed with NERC, enabling better association of transmission and generation outages. The continued alignment between these efforts is expected to enhance the ability to conduct effective event analyses as well as identify key reliability areas for trend analyses of multiple databases. This is expected to improve the depth of event analyses across the ERO Enterprise and expand the quality of data gathered for sophisticated statistical and probabilistic analyses. This will lead to trends and insights about reliability performance, as well as effective measures and actions to address reliability risks. Performance Analysis has begun data mining of completed Event Analysis efforts to see if any insight might be gained from these events as the grid evolves that were not first and foremost or particularly relevant to enhanced grid reliability at the time of the original event investigation. Performance Analysis is currently refining the composition of NERC s annual SOR Report to expand the GADS data trend analysis and, for 2017, has begun reflecting post-seasonal reliability review, insights from analysis of transmission, generator, and demand response data systems (TADS, GADS, and Demand Response Availability Data System - DADS), and integration of event analysis and misoperations. Also, in 2018, the department will implement the decision of whether the SOR Report should move from a calendar year (Q1-Q4) report to a fiscal year (Q4-Q3) report. Further, Performance Analysis will continue to work closely with other organizations, including but not limited to the EPRI, the DOE, the IEEE, INPO, the NATF, the NAGF, and the CEA. Performance Analysis collaborates with these groups on a number of fronts, including TADS, GADS, and DADS Goals and Deliverables In 2018, Performance Analysis has a number of specific goals and deliverables in support of the ERO Enterprise Strategic Plan, including: Issue the SOR Report, guidelines, recommendations, and alerts as needed (including the verification and validation of data and information through Regional Entities and technical committees, as required); 59

63 Section A 2018 Business Plan and Budget Program Area and Department Detail Oversee and evaluate reliability trends that identify reliability risks by analyzing data contained in NERC s GADS, TADS, and DADS, along with reliability metrics and protection & controls system misoperations data; Work within the OC structure to support the Resource Subcommittee and its working groups with emphasis on data collection and analysis, as well as implementation of ERO responsibilities, for the BAL reliability standards; Support NERC Reliability Standard development by providing subject matter expertise; Provide support and leadership to the standing committees subcommittees, working groups, and task forces serving the standing committees (primary focus on the Performance Analysis Subcommittee and its subgroups); Assist in the development of approaches to registration and provide input to NERC staff in support of the development of CMEP risk elements; Conduct major event investigations, analyses, and reporting of major findings, recommendations, and lessons learned that will improve reliability; and Provide insight on emerging system protection issues, and hand-off any issues gleaned with future implications to RASA. Resource Requirements Personnel There is no change in personnel from the 2017 to 2018 budget. Contractor Expenses Performance Analysis s 2018 budgeted contractor and consultant expenses are $572k, which is a $44k increase over 2017, primarily due to an increased need for OATI technology updates. Additional details are provided in Exhibit C Contractor and Consulting Costs. 60

64 Section A 2018 Business Plan and Budget Program Area and Department Detail Statement of Activities and Fixed Assets Expenditures 2017 Budget & Projection, and 2018 Budget PERFORMANCE ANALYSIS Variance Variance 2017 Projection 2018 Budget v 2017 Budget 2018 v 2018 Budget Budget Projection Over(Under) Budget Over(Under) Funding ERO Funding NERC Assessments $ 4,821,146 $ 4,821,146 $ 0 $ 4,676,881 $ (144,265) Assessment Stabilization Reserve - Penalties 87,475 87, (87,475) Total NERC Funding $ 4,908,621 $ 4,908,621 $ 0 $ 4,676,881 $ (231,740) Third-Party Funding $ - $ - $ - $ - $ - Testing Fees Services & Software - 50,000 50,000 50,000 50,000 Workshops Interest 234 5,077 4,843 4,842 4,608 Miscellaneous Total Funding $ 4,908,855 $ 4,963,699 $ 54,843 $ 4,731,723 $ (177,133) Expenses Personnel Expenses Salaries $ 1,349,579 $ 1,302,186 $ (47,393) $ 1,371,401 $ 21,822 Payroll Taxes 92,093 88,724 (3,369) 91,976 (117) Benefits 143, ,051 (7,053) 152,205 9,102 Retirement Costs 149, ,161 (1,856) 152,756 3,739 Total Personnel Expenses $ 1,733,794 $ 1,674,122 $ (59,671) $ 1,768,339 $ 34,545 Meeting Expenses Meetings $ 1,000 $ 15,000 $ 14,000 $ 11,000 $ 10,000 Travel 118,172 98,000 (20,171) 80,000 (38,172) Conference Calls 2,965 0 (2,964) - (2,965) Total Meeting Expenses $ 122,137 $ 113,001 $ (9,135) $ 91,000 $ (31,137) Operating Expenses Consultants & Contracts $ 528,082 $ 528,082 $ 0 $ 572,030 $ 43,948 Office Rent Office Costs 74,843 74, ,812 (17,031) Professional Services Miscellaneous Depreciation - 39,591 39, , ,999 Total Operating Expenses $ 603,426 $ 643,017 $ 39,591 $ 774,341 $ 170,916 Total Direct Expenses $ 2,459,356 $ 2,430,141 $ (29,215) $ 2,633,680 $ 174,325 Indirect Expenses $ 2,290,564 $ 2,323,341 $ 32,777 $ 2,205,182 $ (85,382) Other Non-Operating Expenses $ - $ - $ - $ - $ - Total Expenses (A) $ 4,749,920 $ 4,753,481 $ 3,562 $ 4,838,862 $ 88,942 Change in Assets $ 158,936 $ 210,217 $ 51,282 $ (107,139) $ (266,075) Fixed Assets Depreciation $ - $ (39,591) $ (39,591) $ (143,999) $ (143,999) Computer & Software CapEx - 449, , Furniture & Fixtures CapEx Equipment CapEx Leasehold Improvements Allocation of Fixed Assets 158,936 66,070 (92,865) 36,860 (122,076) Inc(Dec) in Fixed Assets (B) $ 158,936 $ 475,479 $ 316,544 $ (107,139) $ (266,075) TOTAL BUDGET (=A+B) $ 4,908,855 $ 5,228,960 $ 320,105 $ 4,731,723 $ (177,133) FTEs (0.41)

65 Section A 2018 Business Plan and Budget Program Area and Department Detail Electricity Information Sharing and Analysis Center (E-ISAC) 26 E-ISAC (including CRISP) (in whole dollars) 2017 Budget 2018 Budget Increase (Decrease) Total FTEs Direct Expenses $ 12,276,689 $ 13,376,865 $ 1,100,177 Indirect Expenses 4,810,185 5,512, ,770 Other Non-Operating Expenses Inc(Dec) in Fixed Assets 1,428, ,013 (1,321,454) TOTAL BUDGET $ 18,515,341 $ 18,996,833 $ 481,492 Background and Scope The Electricity Sector Information Sharing and Analysis Center (ES-ISAC) was formed in 1998 when the U.S. Secretary of Energy requested that NERC serve as the ISAC 27 for the Electricity Subsector. 28 This department was rebranded to the Electricity Information Sharing and Analysis Center (E-ISAC) in September The E-ISAC reduces cyber and physical risk to the electricity industry across North America by providing unique insights, leadership, and coordination. The vision is to be the trusted, timely, actionable resource of grid risk information and analysis to enhance electricity reliability. The E-ISAC facilitates electricity industry and cross-sector coordination regarding physical security and cybersecurity events affecting the grid. Maintaining Separation from Compliance and Enforcement In February 2012, and as amended in March 2013, the Board of Trustees approved an E-ISAC Policy Statement that established a separation between the E-ISAC and NERC s compliance and enforcement program. In 2015, physical separation of the E-ISAC was completed. The company also has in place an E- ISAC Code of Conduct 29 and Policy on the Role of the E-ISAC vis-à-vis NERC s Compliance Monitoring and Enforcement Program 30. Key Efforts Underway With industry support, in coordination with the ESCC and its MEC, senior management is committed to enhancing the effectiveness and capabilities of E-ISAC operations. These efforts include ongoing enhancement in organizational structure, operational and analytical capabilities, as well as the development of metrics to track the effectiveness of operations. Management will also take steps to improve the quality and value of E-ISAC products, including ongoing review of registered user needs. During 2015, as part of a periodic review of companywide resource needs and resource allocation, NERC allocated additional resources to support the E-ISAC. Management recruited personnel to fill open positions, and recruited and appointed a senior vice president and chief security officer in charge of E- 26 In 2015, NERC combined its Critical Infrastructure Department (CID) into the E-ISAC for both operational and financial reporting purposes. 27 The Information Security Analysis Center (ISAC) construct was conceived and operates under US Government authorities derived from Presidential Decision Directive 63, which was signed in The ISAC focuses specifically on information sharing, analytics and sector activities directly related to the protection of critical infrastructure. 28 Subsequent administrations have sought to continue and strengthen information sharing in other sectors by establishing other sector-specific ISACs. In 2013, the Department of Energy (DOE) again reaffirmed its desire for NERC to continue to operate the E-ISAC. 29 E-ISAC Code of Conduct 30 Policy on the Role of the E-ISAC vis-à-vis NERC s Compliance Monitoring and Enforcement Program 62

66 Section A 2018 Business Plan and Budget Program Area and Department Detail ISAC operations. Ongoing resource requirements consist primarily of personnel, contractors, consultants, software, hardware and communications infrastructure to gather, analyze, and provide information regarding cyber and physical security threats. In the fourth quarter of 2014 and with broad industry support, NERC also assumed management responsibility for the Cybersecurity Risk Information Sharing Program (CRISP). CRISP is a public-private partnership whose purpose is to facilitate the sharing of cyber threat information and to develop situation awareness tools that enhance the electricity sector s ability to identify, prioritize, and coordinate the protection of its critical infrastructure. CRISP provides critical infrastructure owners and operators the capability to voluntarily share cyber threat data, analyze this data, and receive machine-to-machine mitigation measures. Information-sharing devices that are installed on participants networks send encrypted data to a CRISP analysis center operated by the Pacific Northwest National Labs (PNNL), which analyzes the data it receives and sends alerts and mitigation measures back to CRISP participants and the E-ISAC through secure communications. CRISP became fully operational in The E-ISAC will continue to work with PNNL, CRISP participants and E-ISAC registered users to strengthen program execution, including both quality and timeliness aspects of information sharing. The 2018 E-ISAC budget maintains the same percentage allocation of CRISP funding requirements from assessments (50%) and from CRISP participants (50%) as In connection with the growth of the program and related support needs from E-ISAC staff, the 2017 E-ISAC budget also reflects an increase in the number of budgeted E-ISAC FTEs allocated to support CRISP. Other new information sharing and analysis tools deployment will further increase the speed and ease of sharing cyber threat information. E-ISAC Long-Term Strategy Over the past several years the E-ISAC has focused on improving its technical and analytical capabilities with a goal of becoming the electricity industry s leading, trusted source for analysis and sharing of security information. Significant support from the Electricity Subsector Coordinating Council (ESCC), the ESCC Members Executive Committee (MEC), the U.S. Department of Energy, and other stakeholders have helped the E-ISAC be responsive to the industry s needs in order to provide unique insights, leadership, and coordination for security matters. At the request of the NERC Board and under the guidance of the ESCC and MEC, executive leadership of the E-ISAC developed a long-term strategic plan, a copy of which is included as Exhibit F E-ISAC Long- Term Strategy. The E-ISAC Long Term Strategic Plan was approved by the MEC on April 24, 2017 and accepted by the NERC Board of Trustees on May 11, The long-term strategic plan is to transform the E-ISAC into a world-class intelligence collecting and analytical capability for the electricity industry. To carry forth this vision, the E-ISAC is planning a continuous and deliberate growth strategy over the next five years that increases both staff and technical resources. While the 2018 BP&B, in its current form, includes a small increase in staff related primarily to analytical capabilities, the long-term strategy, as further described in Exhibit F E-ISAC Long-Term Strategy, significantly expands on the resources and activities discussed in this section, and those incremental costs are not yet reflected in this 2018 draft budget. Program Level Support CRISP During 2017 and 2018, NERC will continue to subcontract to PNNL the majority of the resource requirements and associated costs to operate and maintain CRISP. 63

67 Section A 2018 Business Plan and Budget Program Area and Department Detail E-ISAC Portal Replacement The E-ISAC communication portal capabilities include publishing immediate notifications and other informational products, exchanging threat indicator information, and providing self-service access to user security awareness services. The E-ISAC is working with NERC Information Technology to completely replace the portal in 2017 to provide important new enhancements and improved capabilities. These include facilitating direct data exchange with E-ISAC members, other ISACs and government partners, and establishing user communities where individuals can discuss security issues. The portal s improved capabilities support E-ISAC analysts in their information analysis functions and directly tie them with their counterparts in other sectors and national laboratories. The 2017 E-ISAC budget includes $1M for the portal enhancements ($250k of which is allocated to CRISP) 31. The MEC has provided written comments in support of this investment. 32 The 2018 E-ISAC budget includes $350k for ongoing portal maintenance and licensing costs. Software and Services Watch Operations Technology The E-ISAC operations center includes monitors used to display intelligence information provided from various software applications. Software integration services are routinely required from vendors providing existing and new software applications. Additional software must be licensed and maintained to display and integrate BES maps that have cyber intelligence information. A technology refresh of displays is planned for Threat Analysis Tools A strong technical analytic capability is needed to develop baselines and identify patterns and understandings of potential cyber-related threats. The analyst workbench toolset maintains historical information and allows a team to use and deliver consistent and repeatable analysis in both an operational (during an event), as well as nonoperational capacity. This workbench will include a threat database for historical correlation and various tools for network- and host-based analysis of malicious software. Cyber Automated Information Sharing System (CAISS) The E-ISAC broadened automated information sharing beyond CRISP, looking at programs such as the Structured Threat Information Expression/Trusted Automated Exchange of Indicator Information (STIX/TAXII) initiative hosted by the U.S. Department of Homeland Security. As part of a work plan developed in consultation with the MEC, in 2017 the E-ISAC piloted these technologies, leveraging existing implementations at Argonne National Lab, into CAISS. The pilot helped the E-ISAC understand the nuances of bi-directional communication, workflow, handling rules, vetting information, and learning from the technology and processes overall. The CAISS pilot will transition to an operational program in Q3 of Intelligence Reporting Services E-ISAC analytic personnel maintain a detailed understanding of emerging vulnerabilities and threats within the broad industrial control systems community, as well as within the more focused BES community. To support this intelligence role, the E-ISAC budget includes the costs for intelligence services from a specialized security information service provider that focuses closely on the electricity subsector. This service gives E-ISAC staff increased understanding of continuing trends, breaking news, and 31 The annual impact of the proposed $1M investment on assessments will be approximately $250,000 since projects of this nature are typically financed through NERC s capital financing program and funded over a three year period. 32 MEC s comments are available on NERC s website 64

68 Section A 2018 Business Plan and Budget Program Area and Department Detail implications to the BES, which they utilize to keep registered entities informed of emerging BES risks through immediate notifications and portal security postings. Events and Outreach Grid Security Exercises Since 2011, NERC has sponsored a series of biennial grid security exercises (GridEx). These geographically distributed exercises are designed to exercise the electricity sector s crisis response to simulated coordinated cybersecurity and physical security threats and incidents, to strengthen utilities crisis response functions, and to provide input for lessons learned. GridEx III, in November 2015, consisted of a two-day grid-focused operational exercise for participants across North America and a half-day tabletop discussion for executives. The E-ISAC manages the program and collects industry information during and after the exercise subject to existing data collection policies. During the exercise, E-ISAC watch and analysis staff exercise the E-ISAC mission and share severe crisis information sharing and analysis towards mitigating the threats and attacks. Lessons learned and recommendations are turned over to groups like NERC s Board and CIPC and to the ESCC for consideration and coordination between industry and government stakeholders. GridEx IV is scheduled for November 15-16, Funding for the two-year planning cycle for GridEx V will be required in 2018 and Grid Security Conferences Since 2011, NERC has sponsored a series of annual grid security conferences (GridSecCon). These conferences bring together industry and government subject matter experts on cyber, physical and operations technology threats and solutions, with training sessions and classified or official use briefs on topics vital to grid security. The E-ISAC provides expertise and gathers appropriate speakers, panelists and training providers. GridSecCon 2017 is scheduled for October in St. Paul, Minnesota, with the 2018 planned for the SPP region in October. Stakeholder Engagement E-ISAC staff routinely engage stakeholders in virtual and in-person meetings, to include CIPC, ESCC, MEC, and BOT meetings, monthly briefings, threat workshops, and presentations to regions, entities, and other stakeholder groups. Resource Requirements Personnel In 2018, resources were added to provide support to the E-ISAC, resulting in a net increase of 3.76 FTEs. This was primarily to address immediate analytical needs and capabilities. The E-ISAC staffing and organizational structure has been updated to reflect two primary focus areas (1) Operations and (2) Programs and Engagement. Operations consists of watch operations, cyber security and CRISP analysis, and physical security analysis groups. Programs and Engagement consists of member engagement, cross-sector engagement, training and exercises, products and services, and program management. Due to the highly technical nature and evolving threat vectors, the E-ISAC staff requires ongoing specialized training and education. The E-ISAC will continue to receive shared services support from NERC s corporate services departments (i.e. Finance and Accounting, Information Technology, Human Resources, Legal and External Affairs). Personnel providing such shared services will do so only in accordance with strict operating protocols 65

69 Section A 2018 Business Plan and Budget Program Area and Department Detail governing access to and use of E-ISAC information as noted above. In addition, the E-ISAC will provide opportunities for qualified interns. Contract Expenses The total budgeted consultants and contracts expense for the E-ISAC for 2018, including CRISP, is approximately $7.3M, an increase of $558k from the 2017 budget. Approximately $6.3M of the 2018 budgeted amount is for CRISP, which is $403k more than was in the 2017 budget. This change is largely due to increased project support needs, as well as higher security review costs. The remaining $1.1M budgeted for 2018 is for other E-ISAC activities, which is an increase of $155k from the 2017 budget. Additional details are provided in Exhibit C Contractor and Consulting Costs. 66

70 Section A 2018 Business Plan and Budget Program Area and Department Detail Statement of Activities and Fixed Assets Expenditures 2017 Budget & Projection and 2018 Budget E-ISAC (including CRISP) Variance Variance 2017 Projection 2018 Budget v 2017 Budget 2018 v 2018 Budget Budget Projection Over(Under) Budget Over(Under) Funding ERO Funding NERC Assessments $ 11,270,705 $ 11,270,705 $ (0) $ 11,765,251 $ 494,546 Assessment Stabilization Reserve - Penalties 183, ,698 (0) - (183,698) Total NERC Funding $ 11,454,403 $ 11,454,403 $ (0) $ 11,765,251 $ 310,848 Third-Party Funding $ 6,990,447 $ 6,990,447 $ 0 $ 7,144,431 $ 153,984 Workshops 70,000 70,000 (0) 70,000 (0) Interest ,136 15,645 17,152 16,661 Total Funding $ 18,515,341 $ 18,530,986 $ 15,645 $ 18,996,833 $ 481,492 Expenses Personnel Expenses Salaries $ 3,417,398 $ 3,553,601 $ 136,203 $ 3,828,883 $ 411,485 Payroll Taxes 204, ,638 10, ,702 29,679 Benefits 397, ,741 13, ,382 70,914 Retirement Costs 363, ,265 (1,216) 413,139 49,657 Total Personnel Expenses $ 4,382,370 $ 4,541,246 $ 158,876 $ 4,944,105 $ 561,736 Meeting Expenses Meetings $ 230,000 $ 230,000 $ (0) $ 127,000 $ (103,000) Travel 256, , ,000 34,512 Conference Calls 6,710 15,000 8,290 - (6,710) Total Meeting Expenses $ 493,198 $ 501,488 $ 8,290 $ 418,000 $ (75,198) Operating Expenses Consultants & Contracts $ 6,788,429 $ 7,172,429 $ 384,000 $ 7,346,794 $ 558,365 Office Rent Office Costs 431, , ,330 (24,565) Professional Services 175, , ,000 0 Miscellaneous Depreciation 5,297 25,496 20,199 85,136 79,838 Total Operating Expenses $ 7,401,121 $ 7,805,321 $ 404,200 $ 8,014,760 $ 613,639 Total Direct Expenses $ 12,276,689 $ 12,848,054 $ 571,365 $ 13,376,865 $ 1,100,177 Indirect Expenses $ 4,810,185 $ 4,879,015 $ 68,831 $ 5,512,955 $ 702,770 Other Non-Operating Expenses $ - $ - $ - $ - $ - Total Expenses (A) $ 17,086,873 $ 17,727,070 $ 640,196 $ 18,889,820 $ 1,802,947 Change in Assets $ 1,428,467 $ 803,916 $ (624,552) $ 107,013 $ (1,321,454) Fixed Assets Depreciation $ (5,297) $ (25,496) $ (20,199) $ (85,136) $ (79,838) Computer & Software CapEx 1,100, ,524 (340,476) 100,000 (1,000,000) Furniture & Fixtures CapEx Equipment CapEx - 21,477 21, Leasehold Improvements Allocation of Fixed Assets 333, ,747 (195,018) 92,149 (241,616) Inc(Dec) in Fixed Assets (B) $ 1,428,467 $ 894,252 $ (534,215) $ 107,013 $ (1,321,454) TOTAL BUDGET (=A+B) $ 18,515,341 $ 18,621,322 $ 105,981 $ 18,996,833 $ 481,492 FTEs

71 Section A 2018 Business Plan and Budget Program Area and Department Detail Training, Education, and Personnel Certification Training, Education, and Personnel Certification (in whole dollars) 2017 Budget 2018 Budget Increase (Decrease) Total FTEs (1.18) Direct Expenses $ 1,922,295 $ 1,710,137 $ (212,157) Indirect Expenses 1,717,923 1,378,239 (339,684) Other Non-Operating Expenses Inc(Dec) in Fixed Assets 117,283 21,598 (95,684) TOTAL BUDGET $ 3,757,501 $ 3,109,974 $ (647,526) Background and Scope Training and Education The Training and Education program provides oversight for coordination and delivery of learning materials, resources, and activities to allow for training and education of: 1. ERO Enterprise staff supporting statutory and delegation-related activities and 2. BPS industry participants consistent with ERO functional program requirements. The Training and Education program supports NERC s responsibilities to develop, adopt, and obtain approval of reliability standards and to monitor, enforce, and achieve compliance with the mandatory standards. Section 901 of the NERC ROP addresses the program s obligations to industry stakeholders and ERO Enterprise staff. The responsibility to participate in the program is shared among the NERC departments 33, in conjunction with the Operational Leadership Team working groups. System Operator certification is maintained by completing NERC-approved continuing education courses and activities. The Personnel Subcommittee, composed of industry training experts, provides oversight of the Continuing Education Program. Section 902 of the NERC ROP addresses the specific continuing education program expectations and activities. Personnel Certification The System Operator Certification program ensures that personnel operating the BPS have the skills, training, and qualifications needed to operate the system reliably. NERC maintains credentials for over 7,500 system operator credential holders who work in various industry areas across North America. NERC s system operator certification exam is designed to test specific knowledge of job skills and reliability standards. It also prepares operators for complying with requirements of reliability standards and appropriately operating the BPS during normal and emergency operations. The System Operator Certification Program is governed by the Personnel Certification Governance Committee (PCGC), an industry group of operations experts, trainers, and supervisors. Certification exams are created by the Exam Working Group (EWG), an industry group of operations subject matter experts. Under the PCGC oversight, the EWG reviews and updates job tasks and certification exams. Section 600 of the NERC ROP addresses the Personnel Certification activities in the area of Operator Certification. 33 The Human Resources department is also engaged in training initiatives. 68

72 Key Efforts Underway Section A 2018 Business Plan and Budget Program Area and Department Detail Training and Education The ERO provides learning materials, resources, and activities to assist industry and ERO Enterprise staff in their understanding of key program areas. These areas include: 1. Risk-Based Compliance Monitoring and Enforcement; 2. Standards and Compliance; 3. Organization Registration and Certification; 4. Event Analysis, Cause Analysis, Performance Analysis, and Lessons Learned; 5. Reliability Assessment and System Analysis; and 6. Continuing education for system operators. Personnel Certification During 2018, the department plans on performing the following activities: 1. Continuing to update System Operator Certification Exam Item Bank to ensure relevance to current Reliability Standards and promote reliability of the BPS; 2. Developing Exam Skills Assessment process to better assess the skills and knowledge of System Operators; 3. Developing Strategic Plan for future System Operator Certification program; and 4. Evaluating credential review and rationalization to maintain credentials Goals and Deliverables Training and Education The annual NERC and ERO Enterprise Learning Priorities Plan articulates and prioritizes the accumulated learning needs for the ERO Enterprise and the potential delivery vehicles supporting achievement of the corporate metrics for the strategic goals. Development and management of the plan is exercised through monthly meetings to ensure priorities are reviewed and updated based on the changing business landscape informed through input received by the various functional program managers on behalf of their respective programs, ERO Enterprise working groups, and leadership teams. A theme-based approach describing audience needs facilitates identification and formulation of appropriate products throughout the year. It inspires modular ( interchangeable parts or building blocks ) thought in implementing a cross-cutting multi-use product model. Production is accomplished by combining in-house expertise and tools with vendor support to increase throughput that positively impacts the quality and timeliness of customer service. NERC program leads spearhead the effort to identify gaps in program knowledge and associated learning needs of their employees, industry stakeholders, and ERO Enterprise partners. The following 2017 themes serve as building blocks for ongoing learning development work and will inform the priorities of focus in 2018 and beyond: Reliability risk management technique: share knowledge for maintaining the reliability of the bulk power system through assessment, analysis, and human interaction. (Industry) 69

73 Section A 2018 Business Plan and Budget Program Area and Department Detail Risk-based compliance performance: enhance compliance monitoring personnel performance through a deeper understanding of ERO Enterprise compliance monitoring processes and technical aspects of the BPS operations. (ERO Enterprise) Functional and technical enhancement: enhance employee understanding of NERC functions and core technical knowledge for regulating the BPS. (NERC employees) These themes provide connectivity of the annual learning development plan with the strategic goals through consideration and analysis of the associated strategic metrics. NERC will also deliver training and education by hosting workshops and webinars, as well as computerbased and instructor-led training courses. The responsibility for subject matter expertise input to the learning development process is shared among multiple departments at NERC. The Training and Education department provides coordination and synchronization efforts for shared NERC and ERO Enterprise training responsibilities in addition to advancing and improving the skills of NERC s operating staff. The Human Resources department budgets and manages the delivery of more traditional corporate employee training and continuing education programs in concert with the coordination and synchronizing efforts of the Training and Education department. The Continuing Education program evaluates and revises the current program criteria as reflected in the program manual. The evaluation considers the growth and maturation of industry programs, as well as ongoing research in the area of adult learning to ensure that the Continuing Education program efforts improve core objectives in addition to fostering improvement of training and promoting quality training programs in general. Personnel Certification The Personnel Certification program delivered new exams one year in advance of the documented exam cycle. Linear On the Fly Testing (LOFT), which is the dynamic creation of exams, was implemented in the newly published 2017 exams. As part of the ongoing exam development cycle, the EWG will continue to develop and analyze new items for future certification exams and ensure relevancy to current NERC Reliability Standards. Key deliverables for the System Operator Certification Program: Annual analysis of exam Item Bank; New exam items; New credential maintenance tool; and Strategic plan for program enhancements. NERC will continue to work with industry stakeholders and the exam development vendor to create certification exams that will promote reliability of the BPS. Resource Requirements Personnel The combined 1.18 reduction in FTEs for the both departments is the result of resource allocations that began in 2016 and will continue throughout 2017 in an attempt to realign staff with current needs. 70

74 Section A 2018 Business Plan and Budget Program Area and Department Detail Contractor Expenses The consulting and contractor budget for 2018 is approximately $599k, which is $18k higher than in Additional detail of the 2018 contractor and consulting budget is set forth in Exhibit C Contractor and Consulting Costs. 71

75 Section A 2018 Business Plan and Budget Program Area and Department Detail Statement of Activities and Fixed Assets Expenditures 2017 Budget & Projection, and 2018 Budget TRAINING, EDUCATION, and PERSONNEL CERTIFICATION Variance Variance 2017 Projection 2018 Budget v 2017 Budget 2018 v 2018 Budget Budget Projection Over(Under) Budget Over(Under) Funding ERO Funding NERC Assessments $ 1,822,089 1,822,089 $ 0 $ 1,370,091 $ (451,998) Assessment Stabilization Reserve - Penalties 43,738 43,738 (0) - (43,738) Total NERC Funding $ 1,865,827 $ 1,865,827 $ 0 $ 1,370,091 $ (495,736) Third-Party Funding $ - $ - $ - $ - $ - Testing Fees 1,921,900 1,921, ,790,000 (131,900) Services & Software Workshops Interest 175 3,721 3,546 3,026 2,851 Miscellaneous Total Funding $ 3,787,902 $ 3,791,448 $ 3,546 $ 3,163,117 $ (624,785) Expenses Personnel Expenses Salaries $ 852,091 $ 714,926 $ (137,165) $ 703,320 $ (148,771) Payroll Taxes 62,727 51,461 (11,266) 52,088 (10,638) Benefits 139,239 91,326 (47,913) 95,319 (43,920) Retirement Costs 97,624 79,246 (18,378) 79,353 (18,272) Total Personnel Expenses $ 1,151,681 $ 936,958 $ (214,723) $ 930,080 $ (221,601) Meeting Expenses Meetings $ 55,000 $ 54,999 $ (1) $ 44,250 $ (10,750) Travel 21,139 27,389 6,250 17,000 (4,139) Conference Calls 11,133 20,000 8,867 - (11,133) Total Meeting Expenses $ 87,272 $ 102,388 $ 15,116 $ 61,250 $ (26,022) Operating Expenses Consultants & Contracts $ 580,600 $ 718,614 $ 138,014 $ 598,900 $ 18,300 Office Rent Office Costs 100, ,323 (0) 117,969 17,646 Professional Services Miscellaneous Depreciation 1,919 1,919 (0) 1,439 (480) Total Operating Expenses $ 683,342 $ 821,356 $ 138,014 $ 718,808 $ 35,465 Total Direct Expenses $ 1,922,295 $ 1,860,702 $ (61,593) $ 1,710,137 $ (212,157) Indirect Expenses $ 1,717,923 $ 1,742,505 $ 24,582 $ 1,378,239 $ (339,684) Other Non-Operating Expenses $ - $ - $ - $ - $ - Total Expenses (A) $ 3,640,218 $ 3,603,208 $ (37,010) $ 3,088,376 $ (551,842) Change in Assets $ 147,684 $ 188,241 $ 40,556 $ 74,741 $ (72,944) Fixed Assets Depreciation $ (1,919) $ (1,919) $ 0 $ (1,439) $ 480 Computer & Software CapEx Furniture & Fixtures CapEx Equipment CapEx Leasehold Improvements Allocation of Fixed Assets 119,202 49,553 (69,649) 23,037 (96,164) Inc(Dec) in Fixed Assets (B) $ 117,283 $ 47,634 $ (69,649) $ 21,598 $ (95,684) TOTAL BUDGET (=A+B) $ 3,757,501 $ 3,650,841 $ (106,659) $ 3,109,974 $ (647,526) FTEs (0.66) 5.88 (1.18) 72

76 Section A 2018 Business Plan and Budget Program Area and Department Detail Administrative Services Administrative Services (in whole dollars) Direct Expenses and Fixed Assets FTEs 2017 Budget 2018 Budget Increase (Decrease) 2017 Budget 2018 Budget Increase (Decrease) General and Administrative $ 10,205,977 $ 10,051,237 $ (154,740) (0.94) Legal and Regulatory 3,292,379 2,947,230 (345,149) (0.94) Information Technology 12,480,846 11,361,806 (1,119,040) (0.94) Human Resources 1,608,583 1,706,056 97, Finance and Accounting 3,827,050 4,033, , Total Administrative Services $ 31,414,834 $ 30,099,407 $ (1,315,427) (1.88) Program Scope and Functional Description NERC s Administrative Services area includes the budget for all business and administrative functions of the organization, including (1) technical committees and member forums, (2) General and Administrative, which includes Board fees and expenses, the CEO, chief reliability officer (CRO) and support staff, communications, external affairs and governmental relations, and office rent, (3) Legal and Regulatory, (4) Information Technology, (5) Human Resources, (6) Finance and Accounting, and (7) other general administrative expenses necessary to support program area activities. These functions are necessary to the existence and functioning of the organization and support the performance of NERC s ERO statutory activities. The costs of the Administrative Services functions are allocated to the statutory programs as indirect expenses. The resource requirements and comparative budget information for each of these functions are described below. Technical Committees and Members Forum Program While NERC management and staff will continue to interact with and support numerous reliability-related forums (e.g., the NATF and NAGF), NERC s 2018 budget does not contain specific funding for any forum activities. General and Administrative Background and Scope The General and Administrative area is responsible for the administration and general management of the organization. Expenses allocated in this area include office rent, as well as personnel and related costs of the CEO, the CRO, the CEO s executive assistant, communications, external affairs, and government relations staff, and Board costs. The 0.94 reduction in FTEs is the result of resource allocations that began in 2016 and will continue throughout 2017 in an attempt to realign staff with current needs. The following table details the Board costs included in the total costs of the General and Administrative area: 73

77 Section A 2018 Business Plan and Budget Program Area and Department Detail Board of Trustee Expenses Budget 2017 Budget 2018 Variance 2018 Budget v 2017 Budget Variance % Meeting and Travel Expenses Quarterly Board Meetings $ 244,000 $ 220,000 $ (24,000) -9.8% Trustee Travel 157, ,000 (27,329) -17.4% Total $ 394,000 $ 350,000 $ (44,000) -11.2% Professional Services Independent Trustee Fees $ 1,226,000 $ 1,202,000 $ (24,000) -2.0% Trustee Search Fees 100, , % Total $ 1,326,000 $ 1,302,000 $ (24,000) -1.8% The reduction in Quarterly Board Meeting and Trustee Travel expenses is the result of more closely aligning the 2018 budget with historical actuals. Legal and Regulatory Background and Scope The Legal and Regulatory department s workload is derived from the following key NERC program areas: Compliance Analysis, Certification and Registration, RASA, Reliability Risk Management, and Standards. In addition, the Legal and Regulatory department is also responsible for providing a wide range of legal support to the NERC management team regarding antitrust, corporate, commercial, insurance, contract, employment, real estate, copyright, tax, legislation, and other legal matters. The department also addresses legal and regulatory matters that arise in connection with the delegation agreements with the Regional Entities. Resource Requirements Personnel The 0.94 reduction in FTEs area is the result of resource allocations that began in 2016 and will continue throughout 2017 in an attempt to realign staff with current needs. Professional Services Outside law firms and consultants supporting this area are budgeted and tracked as Professional Services. The Professional Services budget for 2018 was $185k lower than in 2017, due to the transfer of those budget dollars to other departments in order to better align the responsibility associated with certain legal costs to those departments. Information Technology Total $ 1,720,000 $ 1,652,000 $ (68,000) -4.0% Background and Scope NERC s IT department plan includes capital and operating expenses required to support, build, configure, and enhance applications that serve registered entities, Regional Entities, and NERC staff. The plan also includes work related to ERO Enterprise data analysis, as well as ongoing NERC internal operations. The focus of the budget is primarily on two programs designed to better support consistency and effectiveness across the ERO Enterprise in the areas of Standards, Compliance, and the associated 74

78 Section A 2018 Business Plan and Budget Program Area and Department Detail assessment of Reliability Risk. These programs are the Entity Registration program and the Compliance Monitoring and Enforcement Technology Program. Both programs are expected to continue from 2017 through to The Entity Registration application will consolidate core registration functions currently distributed across three applications into a single registration application. In similar fashion, the three applications used across NERC and the Regional Entities for enforcement processing will be replaced by a single common application that also provides additional compliance monitoring functionality. These investments will provide broad benefits across the ERO Enterprise in terms of the efficiency and effectiveness of our operations and meeting our reliability goals. Additionally, by working to provide more services to the registered and Regional Entities in terms of tools and systems, associated economies of scale will result in these initial investments providing increasing value across the ERO Enterprise in the years to come. The budget year projection also includes improvements to our public facing website, NERC.com. The budget is broken down into four categories as follows: 1. ERO Enterprise New Functionality Items listed in this category are those items designed to add, enhance, or improve capabilities for registered entities, Regional Entities, and NERC staff. This includes Entity Registration, the Compliance Monitoring and Enforcement Technology Program, NERC.com, and other legacy applications. 2. ERO Enterprise Infrastructure & Support Items listed in this category are those infrastructure and support items required for applications used by registered entities, Regional Entities, and NERC staff. Items include Security and applications used by the ERO Enterprise such as The Events Analysis Management System (TEAMS), the Bulk Electric System Notification and Exception System tool (BESnet), the Standards Balloting System (SBS), the Reliability Coordinator Information System (RCIS), User Management and Records (UMR), and numerous other applications. 3. NERC New Functionality There is no new functionality targeted until the 2019 budget year is heavily focused on improving the registered and Regional Entity experience. 4. NERC Infrastructure & Support Items listed in this category are primarily those items required to maintain and run the internal office infrastructure, and support NERC staff operations. Items include server hardware and software licenses, network equipment, data and telecommunication circuits, and data storage, as well as office administrative applications (e.g., Microsoft Office) and user hardware such as laptops and peripherals. A further discussion of each item is outlined below. ERO Enterprise New Functionality As noted above, this category is primarily those applications or systems designed to improve or add capability to registered entities, Regional Entities, and NERC staff. Over the past two years, IT has been successful at deploying a number of new applications and functionality for the ERO Enterprise that have now moved into support. In 2018 and beyond, IT will continue that trend with a heavy focus Entity Registration and the Compliance Monitoring and Enforcement Technology Program. a. Entity Registration The objective of the Entity Registration program is to take the core registration functions currently distributed across three systems -- OATI webcdms, Guidance CITS, and Guidance CRATS -- and move those functions to a single, consolidated registration system. Doing so will allow for an expansion of current functionality, more control over the future 75

79 Section A 2018 Business Plan and Budget Program Area and Department Detail of the application, and ultimate reduction in costs through the long-term transfer of the remaining functions provided by those three systems into a single, common system. This program will be implemented via multiple projects during the next four years. This first project in 2017 will address the registration, tracking, and management of Coordinated Functional Registrations (CFRs). Subsequent projects will address Joint Registration Organizations (JROs), tracking Coordinated Oversight of Multi-Region Registered Entities (MRREs), consolidating all existing entity registration functions into a single platform, adding validation of business relationships and functional responsibilities, and the capability to integrate reliability and compliance data for risk analysis purposes (supporting the creation of an entity s risk profile). b. Compliance Monitoring and Enforcement Process Tools IT will work closely with the Regional Entities in 2017 and through the budget cycle to evaluate and implement strategic investments in tools that replace the current three applications mentioned above with a single, consolidated Compliance Monitoring and Enforcement Process application. Items under consideration at this time include how Reliability Standards data is stored and maintained, as well as how best to support the various parts of the compliance monitoring and enforcement process (e.g., analysis of risk, development of implementation plans and audit schedules, actual compliance monitoring, and enforcement processing). Funding for any capital investments in these areas will be subject to review and approval as part of the business plan and budget application in the year when such investments are proposed to be made. Prior to actual start of each project, the project will be reviewed through the enterprise information technology investment planning process to ensure the project s estimated costs and benefits are reasonable and justify investment. For more information on this process, see Robust Planning for New Capital Projects below. ERO Enterprise Infrastructure & Support This category primarily consists of items used by registered entities, Regional Entities, and NERC Staff. Information Technology has worked closely with the Regional Entities to design and configure a number of ERO Enterprise applications, with a bias toward using Commercial-off-the-Shelf (COTS) technology whenever possible. Infrastructure and support for these COTS tools (such as SharePoint and the Dynamics xrm platform), as well as custom built applications developed in the past, require ongoing investment to maintain continuous operations. For many applications and systems, this includes the cost of maintaining development, quality assurance, and staging and production environments, which are required to ensure the security and operational integrity and stability of the multiple applications supported for the ERO Enterprise. These applications and systems are monitored, tested (including penetration and vulnerability testing), and maintained in a manner as to ensure the highest level of integrity, security, and availability to the roughly 4,000 users across North America. IT continues to place emphasis on ensuring the environment is configured in a manner consistent with enterprise best practices, ensuring the security and integrity of the environment while allowing ERO Enterprise users to obtain the information and resources required to perform various analyses. Ongoing support for applications such as TEAMS, Misoperations Information Data Analysis System (MIDAS), SBS, the Reliability Analysis Data System (RADS), in addition to numerous legacy ERO Enterprise products, make up this portion of the IT budget. NERC New Functionality There is no new functionality planned for the NERC environment in the 2018 budget year. In 2019 funding is projected for implementation of a separate document management application for the E-ISAC. 76

80 Section A 2018 Business Plan and Budget Program Area and Department Detail NERC Infrastructure & Support As previously noted, NERC Infrastructure & Support are those items required to maintain and support the internal infrastructure for NERC staff. Items such as file servers, network equipment, storage, Microsoft Office (Word, Excel, PowerPoint, , SharePoint, etc.), along with security and telecommunications, are required to ensure staff have the necessary tools and technology to perform their daily operational functions. Emphasis in the planning cycle will continue to be placed on optimizing the amount of effort placed on NERC infrastructure and support in order to minimize spend on internal office steady state operations, allowing a larger portion of IT resources to focus on new ERO Enterprise functionality, as well as ERO Enterprise infrastructure and support. As a result of this effort, the 2018 NERC Infrastructure & Support is expected to be less than Examples of items included in internal operations are outlined below: a. Compliance Reporting and Tracking System (CRATS) This compliance database is used to track violations, mitigation plans, and reporting required by NERC as the certified ERO. The compliance database has additional modules, such as the Standards, Technical Feasibility Exceptions (TFEs), and Registration module, which contains a list of all registered entities. Funding requirements include ongoing maintenance for the CRATS compliance tools. b. Meeting Manager, ERO Membership, Central Repository of Curtailment Events NERC maintains a number of legacy applications. Many of the legacy applications were developed and implemented five to ten years ago and are unable to benefit from contemporary application development. Some of these applications may have to be completely rewritten, or moved to the xrm application platform, as IT was able to do with Application Broker, NERC MyAccount, and UMP in Funding in 2018 is required for ongoing maintenance and enhancements until the applications can be rewritten or moved to the xrm platform or, in some cases, potentially divested or transferred to industry support. c. Quarterly Penetration and Vulnerability Testing All NERC Networks and Systems Expert consulting services to provide ongoing intrusion detection and vulnerability testing of the NERC public website and NERC s network, applications, and systems, is an essential requirement of ongoing operations. NERC is subject to frequent intrusion attempts where external parties try to gain access to its systems and infrastructure. Any vulnerability identified is documented and provided to NERC IT for rapid remediation. d. NERC Security Program NERC s IT department performs a number of technology initiatives to ensure the security of the network and infrastructure. However, in order to continually improve security, a more holistic approach is required that implements technology improvements and constructs an overarching security program to ensure all aspects of security have been considered, including information classification, review of retention policies, and enforcement of security guidelines. Security remains an area of focus during the budget cycle. Robust Planning for New Capital Projects The company has adopted an enterprise information technology investment planning methodology that ensures only projects with compelling and approved business cases are funded. The approval process uses four approval gates: A Business Unit Sponsor approval gate; A NERC VP/CTO approval gate; An ERO Technology Leadership Team (TLT) (comprised of the NERC CEO and two Regional Entity CEOs) approval gate; and The full ERO EMG (CEOs of NERC and each Regional Entities) approval gate. 77

81 Section A 2018 Business Plan and Budget Program Area and Department Detail This gated process provides the required rigor and discipline to ensure only high value enterprise IT investments are pursued. In addition, all Enterprise IT investments are subject to ongoing oversight by a subgroup consisting of four members of the NERC Board s SOTC. The company will continue to use this process for the budget planning cycle. TEAMS, RADS, and the document management program are three examples of applications or programs for which investments were approved in 2016 and the same planning methodology will be used during for Entity Registration and the Compliance Monitoring and Enforcement Technology Program application. TEAMS The TEAMS application provides integration of events data systems, while enabling a more efficient and effective method for event data collection, tracking, analysis and reporting. This enhances the ability of the ERO and stakeholders to identify and focus on significant and emerging reliability risks. This tool is used by NERC and the Regional Entities, providing a consistent experience for all ERO Enterprise clients involved in the events analysis business process. The benefits provided by the TEAMS application streamline ERO Enterprise reliability data sources with an event data collection platform that is consistent with the event analysis process. Benefits include: Increasing Efficiency: TEAMS helps ensure the reliability of the Bulk Power System by facilitating: o o o o o The reporting of a BPS event The evaluation of BPS events The undertaking of appropriate levels of Events Analysis The generation of lessons learned The generation of reliability trend analysis Additionally, increased efficient and effective collaboration among NERC and the Regional Entities has resulted from the centralization and appropriately secure distribution of information across Regions (including Events Analysis results, trending analysis, and lessons learned), and the increased clarity and standardization of processes provided by the software solution. Mitigating Reliability Risk: TEAMS enables the ERO Enterprise to integrate event reports with other reliability data sources and develop portfolios of risk information. This integration enables a more complete analysis into the cause of events, including transmission outages, generation trips, and load loss. With this analysis, the ERO Enterprise can better identify unplanned service interruptions and spotlight key areas for reliability improvement, with the ultimate goal of reducing the probability and reliability impact of future system events. RADS The RADS application provides for a more efficient method for NERC to complete seasonal and long-term reliability assessment reports. Specifically, RADS automates the importing of data, provides for ad hoc and pre-defined reporting, and provides access to historical data. A recent benchmarking exercise indicated that RADS enabled a routine data import process to be completed in 22 minutes as compared to prior manual work efforts totaling roughly 80 hours. This process improvement has allowed NERC s analysts and engineers to spend more time analyzing reliability and less time importing and managing data. Additional benefits of RADS include: 78

82 Section A 2018 Business Plan and Budget Program Area and Department Detail Mitigating Reliability Risk: By allowing analysts to refocus their efforts on higher value work, the implementation of RADS is resulting in more and better analyses of future conditions and risks. Increase Work Quality: Part of the reason for the respected status of the ERO Enterprise and its assessments conducted and published by the ERO Enterprise is the high level of quality embodied within its documents. If factual errors were introduced into NERC s reliability assessments, such errors would considerably diminish the ERO Enterprise s credibility. By centralizing information and reducing the number of manual interventions required to manage data, the RADS aids in ensuring that the information contained within NERC assessments is accurate and correct. Reduced Corporate Risk: NERC has obligations to ensure the integrity and security of assessment data. Having a central place to manage and store assessment data has reduced the number of instances of confidential proprietary data being handled and managed at NERC. As such, the risk of accidental inappropriate disclosure has been reduced. Document Management As a third example, as described previously, NERC commenced implementation of a document management program during 2015 and will complete implementation in The evaluation of the cost-benefit of the document management program indicated tremendous value to the organization, primarily in terms of addressing the business requirements set forth above. The cost benefit analysis of this project also demonstrated that NERC's projected average cost per user is comparable to market. In addition, assuming achievement of modest personnel efficiency gains (between 2-7 percent) from using the new system, the program will generate value in terms of increased resource availability well above anticipated costs. The project was reviewed in depth with the Board s SOTC and Finance and Audit Committee, which, together with the Board, authorized reserve funding at their May 2015 meetings to commence initiation of the program. For all three of these projects, NERC s planning process and associated approval gates resulted in thorough review of both costs and benefits of the proposed technology projects prior to moving forward. As the planning process has matured, NERC has also begun to analyze potential benefits to the Regional Entities when considering the benefits from potential IT investments. In the Enterprise Reporting GADS business case brought before the ERO TLT in April, NERC included estimates of productivity gain in terms of both NERC staff and the staff of the Regional Entities. NERC estimated that across the ERO Enterprise, in the first year of operation, 32 Regional Entity employees would save roughly 10 hours of time per employee and 42 NERC employees would save roughly 29 hours of time per employee, with benefits increasing in future years as users became more familiar with the system and as the system was expanded with additional data. This saved time represents additional value that those employees can provide by not having to manage data or duplicate work. Beyond this analysis, the business case considered less quantifiable benefits to both NERC and the Regional Entities in terms of supporting the ERO Enterprise Strategic Plan and reducing reliability risk. As the planning process continues to develop and mature, NERC will continue to expand incorporation of regional staffing and budget impacts into its business case analysis, as well as identifying economies of scale, efficiency improvements, and enhancements to reliability through IT investment. 79

83 Resource Requirements Section A 2018 Business Plan and Budget Program Area and Department Detail Personnel The 0.94 reduction in FTEs is the result of resource allocations that began in 2016 and will continue throughout 2017 in an attempt to realign staff with current needs. Contractor Expenses The 2018 budgeted amounts are set forth in Exhibit C Contractor and Consulting Costs, with a comparison to 2017 budgeted amounts. The $189k decrease in the 2018 budget compared to 2017 is primarily due to the transfer of budgeted funds from contracts and consultants to cover needs in fixed assets (capital) costs. IT Office Costs The below table shows the major categories of IT Office Costs, and a short description of certain categories follows thereafter. Office Costs Budget 2017 Budget 2018 Variance 2018 Budget v 2017 Budget Variance % Telephone $ 230,000 $ 281,600 $ 51, % Telephone Answering Service 2,500 - (2,500) % Internet 358, , % Computers 25,000 - (25,000) % Computer Supplies 98,100 98, % Maintenance and Service Agreements 1,706,088 1,728,030 21, % Software 59,000 55,000 (4,000) -6.8% Subscription and Publications 108, ,200 57, % Dues 2,500 2, % Express Shipping 5,000 7,500 2, % Audio/Visual Lease - 494, , % Computer Lease - 95,348 95, % Total $ 2,595,408 $ 3,288,186 $ 692, % Telephone Telephone costs are items associated with cellular phone, mobile laptop cellular air card, and Session Internet Protocol (SIP) data circuits. Internet Internet expense is comprised of data circuits and redundant capability in the event of primary service provider failure. Computer Supplies and Maintenance Computer supplies are expense items required for infrastructure support. Maintenance and service agreements are required to support internal and external access to routers, switches, firewalls, intrusion protection, file servers, audiovisual equipment, storage area networks, data backup services, network and security monitoring, co-location data center services, video conferencing, digital certificates, and development and virtualization software. Service agreements related to the co-location data center, offsite backup of data, conference calling, and network and security monitoring comprise a large portion of the maintenance and service agreements budget. 80

84 Section A 2018 Business Plan and Budget Program Area and Department Detail Software Tools such as Adobe Creativity Suite, remote support tools, and various other IT support tools are included under this line item. The tools are primarily used for NERC infrastructure purposes to support and manage the application, server, and network environment. Audio/Visual and Computer Leases These items consist of audio visual equipment, computers, and laptops that were leased, in lieu of purchasing, beginning in late Whereas these items were included in fixed assets in the 2017 budget, they are included in office supplies in the 2018 budget. Fixed Asset (Capital) Expenses The following table presents a summary of NERC s IT 2018 fixed asset (capital) budget 34 compared to the 2018 budget: IT Capital Budget Budget 2017 Budget 2018 Variance 2018 Budget v 2017 Budget Variance % ERO Application Development* $ 700,000 $ - $ (700,000) % Document Management Program 335,000 - (335,000) % Hardware (storage, servers) 891, ,000 (186,000) -20.9% Other Equipment 885, ,000 (515,000) -58.2% Disaster Recovery 150, ,000 (50,000) -33.3% NERC Software Licenses 311, ,000 (10,000) -3.2% Total $ 3,272,000 $ 1,476,000 $ (1,796,000) -54.9% * NERC's total 2018 ERO Application Development budget is $2,100,000 and includes $1,500,000 budgeted in the Compliance Enforcement department for the CMEP Tool and $500,000 budgeted in the Compliance Analysis, Organization Registration and Certification department for the Entity Registration Tool. As in prior years, the goal of the fixed assets (capital) program for the planning period is to provide access, visibility, and analysis of data from many different sources. This requires ongoing investments in hardware, software, and associated tools. The overarching theme is to securely gather, analyze, and maintain data across the ERO Enterprise to support ERO operations. Adding the capability to centralize and mine data in addition to foundational elements such as the Microsoft xrm application, SharePoint 2013, and disaster recovery and enhanced security sets the stage for vastly improved reporting and business intelligence. It also allows the capability for collaboration and sharing of information vital to the ERO s mission. In addition to the investments described in the preceding paragraph to support efficiency and consistency across the Enterprise, the 2018 budget also includes the cost of, network assets, software, servers, laptops, and other hardware to support daily operations. 34 NERC s total 2018 fixed asset (capital) budget is $3,676,000 and includes $2,100,000 for ERO Application Development, as discussed in the note below the table, as well as $100k budgeted in CRISP for other costs. 81

85 Human Resources Section A 2018 Business Plan and Budget Program Area and Department Detail Background and Scope Human Resources manages all of NERC s human resources functions, including staffing, benefits administration, employee relations, performance and compensation management, and training and development. Management has implemented a robust, objective, and auditable performance management system to track corporate and individual performance against pre-established goals, objectives, and measures. Each year NERC continues to refine and improve this system. Leadership, Management, and Professional and Administrative Staff Training and Development As part of the ERO Enterprise s ongoing efforts to engage and retain highly qualified talent with the leadership and technical skills to support the mission, NERC s executives, managers, and professional and support staff participate in ongoing training and development to improve competencies critical to success and succession planning for critical roles. As such, NERC will continue to invest in learning opportunities in several areas. First, Human Resources will continue to host and optimize an e-leaning platform, SkillSoft, to provide staff resources for improving soft and technical skills. Second, Human Resources will provide broad-based staff development training though real-world access via tours of and training on control centers, electric substations, and power generation plants. Finally, staff will have access to additional education, including but not limited to degree-oriented university education, pursuit of specialized certifications, and other in-house and external training that provides essential competencies and skills development that will lead to improved organization performance. Compensation Consulting Consultants are periodically retained to examine appropriate compensation based on current market data. This ensures that decisions affecting compensation are made in light of the current market climate and that qualified employees are attracted and retained within a defined total remuneration range. NERC also periodically retains compensation subject matter experts to perform periodic assessments of the Board compensation model to ensure alignment with market practices. Surveys NERC periodically retains a vendor to conduct Board and committee effectiveness surveys to identify improvement opportunities. Human Resources will also launch additional surveys as appropriate, based on business needs, which may include periodic internal climate surveys. Succession Planning Minimizing disruption of knowledge, skill, and experience of key staff is critical to the company s success. Human Resource works with senior management to identify essential roles and develop strategies to build succession and contingency plans for any loss of staff. Human Resources Products and Services Automation Human Resource will continue to operate, maintain, and investigate investment in additional electronic platforms for Human Resource support services that reduce administrative burden and improve employee access to tools and information. Resource Requirements Personnel There is no change in FTEs in 2018 compared to

86 Section A 2018 Business Plan and Budget Program Area and Department Detail Contractor Expenses Contractor and consultant expenses are set forth in additional detail in Exhibit C Contractor and Consulting Costs. The increase over 2017 is primarily due to increased investments for additional leadership and staff training, as well as funding for the bi-annual compensation study. Miscellaneous Expenses Miscellaneous expenses include community responsibility and employee engagement, the year-end employee appreciation event, and employee rewards and recognition. Finance and Accounting Background and Scope NERC s Finance and Accounting department manages all finance and accounting functions, including employee payroll, 401(k), 457(b), and 457(f) plans, travel and expense reporting, monthly financial reporting, sales and use tax, meeting and events planning and services, insurance, internal auditing, and facilities management. This area also holds primary responsibility for the development of the annual business plan and budget, as well as NERC s proposed ERO risk management framework. Over the past several years, NERC s Finance and Accounting department implemented additional policies, procedures, and controls governing day-to-day practices including contract and personnel procurements, meetings, conference planning and travel, expense reimbursement, and back office systems and procedures. The department will continue to refine, improve and, where necessary, implement additional procedures and controls. Resource Requirements Personnel The 0.94 reduction in FTEs is the result of resource allocations that began in 2016 and will continue throughout 2017 in an attempt to realign staff with current needs. Contractor Expenses Outside contractor and consulting support, budgeted at $427k, represents a decrease compared to the 2017 budget. These costs are primarily for outside professional support for auditors to support various risk management and internal control and audit intiatives, as well as to provide finance and accounting support. 83

87 Section A 2018 Business Plan and Budget Program Area and Department Detail Statement of Activities and Fixed Assets Expenditures 2017 Budget & Projection, and 2018 Budget ADMINISTRATIVE SERVICES Variance Variance 2017 Projection 2018 Budget v 2017 Budget 2018 v 2018 Budget Budget Projection Over(Under) Budget Over(Under) Funding ERO Funding NERC Assessments $ 519,083 $ 519,083 $ (0) $ (385,000) $ (904,083) Assessment Stabilization Reserve - Penalties Total NERC Funding $ 519,083 $ 519,083 $ (0) $ (385,000) $ (904,083) Third-Party Funding $ - $ - $ - $ - $ - Testing Fees Services & Software Workshops Interest Miscellaneous Total Funding $ 519,083 $ 519,083 $ (0) $ (385,000) $ (904,083) Expenses Personnel Expenses Salaries $ 11,858,590 $ 11,584,862 $ (273,728) $ 11,635,050 $ (223,540) Payroll Taxes 669, ,827 (15,472) 651,031 (18,268) Benefits 1,333,443 1,382,952 49,509 1,444, ,002 Retirement Costs 1,073,642 1,005,149 (68,493) 1,007,404 (66,238) Total Personnel Expenses $ 14,934,974 $ 14,626,790 $ (308,185) $ 14,737,931 $ (197,043) Meeting Expenses Meetings $ 350,000 $ 352,501 $ 2,501 $ 375,500 $ 25,500 Travel 653, ,561 61, ,000 (83,945) Conference Calls 19, , , , ,294 Total Meeting Expenses $ 1,023,251 $ 1,336,113 $ 312,862 $ 1,065,100 $ 41,849 Operating Expenses Consultants & Contracts $ 3,359,787 $ 3,497,623 $ 137,836 $ 3,290,966 $ (68,821) Office Rent 3,117,009 3,117, ,091,804 (25,205) Office Costs 3,275,952 3,548, ,599 3,993, ,746 Professional Services 2,293,135 2,293, ,294,408 1,273 Miscellaneous 32,000 37,251 5,251 34,500 2,500 Depreciation 1,233,650 1,237,175 3, ,159 (252,491) Total Operating Expenses $ 13,311,534 $ 13,730,745 $ 419,211 $ 13,686,535 $ 375,002 Total Direct Expenses $ 29,269,759 $ 29,693,647 $ 423,888 $ 29,489,566 $ 219,807 Indirect Expenses $ (29,376,484) $ (29,796,847) $ (420,363) $ (29,604,566) $ (228,082) Other Non-Operating Expenses $ 106,725 $ 106,725 $ (0) $ 115,000 $ 8,275 Total Expenses (A) $ - $ 3,525 $ 3,525 $ (0) $ (0) Change in Assets $ 519,083 $ 515,558 $ (3,525) $ (385,000) $ (904,083) Fixed Assets Depreciation $ (1,233,650) $ (1,237,175) $ (3,525) $ (981,159) $ 252,491 Computer & Software CapEx 1,472,000 1,017,000 (455,000) 301,000 (1,171,000) Furniture & Fixtures CapEx Equipment CapEx 1,800,000 1,064,000 (736,000) 1,175,000 (625,000) Leasehold Improvements Allocation of Fixed Assets (2,038,350) (847,350) 1,191,000 (494,841) 1,543,509 Inc(Dec) in Fixed Assets (B) $ - $ (3,525) $ (3,525) $ - $ - TOTAL BUDGET (=A+B) $ - $ 0 $ 0 $ (0) $ (0) FTEs (1.15) (1.88) 84

88 Section B Supplemental Financial Information Breakdown by Statement of Activity Sections The following detailed schedules support the consolidated Statement of Activities. All significant variances were described by program area in the preceding pages. Table B-1 Operating Reserve and Assessment Analysis Operating Reserve and Assessment Analysis Statutory Total Reserves Future Obligation Reserve 1 Operating Contingency Reserve System Operator Certification Reserve CRISP Reserve Assessment Stabilization Reserve Beginning Operating Reserves Balance - 1/1/2017 $ 8,782,011 $ 2,875,467 $ 2,307,531 $ 828,013 $ 500,000 $ 2,271,000 Generation or (Use) from 2017 Operations From 2017 budgeted operations $ 192,628 $ - $ 104,551 $ 18,952 $ 69,124 $ - From 2017 approved use of reserves (1,363) 84,623 (85,986) Proceeds from financing activities (non-current portion only) 2 966, , Debt service 3 (719,522) - (719,522) Other adjustments to reserves 4 (1,128,397) (528,397) (600,000) Projected Operating Reserves - 12/31/17 $ 8,092,024 $ 2,431,694 $ 2,573,241 $ 846,965 $ 569,124 $ 1,671,000 Required Working Capital and Operating Reserves - 12/31/18 5 $ 8,095,585 $ 1,951,237 $ 2,573,241 $ 900,108 $ 500,000 $ 2,171,000 Adjustment in funding to achieve required reserve balance (427,314) (480,457) - 53, Penalty sanctions received 7/1/2016-6/30/2017 (See Table B-2) 500, ,000 Less: Assessment Stabilization Reserve Release - Penalties Total Adjustments to Reserves $ 72,686 $ (480,457) $ - $ 53,143 $ - $ 500,000 Assessment Reconciliation The cells below this are in white font make them black font when updating! 2018 Expenses and Capital Expenditures $ 71,376,999 $ 61,878,784 $ 1,137,947 $ 8,360,268 Less: Assessment Stabilization Reserve Release - Penalties Adjustment in funding to achieve required reserve balance 53,143-53,143 - Less: Other Funding Sources (9,240,931) (906,500) (1,190,000) (7,144,431) Less: Proceeds from financing activities (non-current only) (1,400,000) (1,400,000) Plus: Debt service 1,015,000 1,015, NERC Assessment $ 61,804,211 $ - $ 60,587,284 $ 1,215,837 $ - 1 As further explained in the discussion of the Working Capital Reserve amount in Exhibit E, the Future Obligations Reserve offsets future, non-current liabilities. The calculation of Working Capital and Operating Reserve balances per 2016 audited financials and as projected for 2017 and 2018 is included with the Statements of Financial Position that follow in Section D - Supplemental Financial Statement. 2 Proceeds from financing amount is equal to two-thirds of the amount financed or to be financed in the year. 3 Debt Service amount is equal to Annual Payments for Debt Service less Interest Expense. See Exhibit D. 4 Represents transactions recored only on the Statement of Financial Position (balance sheet) and do not impact the Statement of Activities (income statement), including recording of capitalized leases, amortization of future obligations and funding the 457f plan. 85

89 Section B Supplemental Financial Information Table B-2 Penalties Penalty Sanctions The NERC Policy Accounting, Financial Statement and Budgetary Treatment of Penalties Imposed and Received for Violations of Reliability Standard, as well as Section of the ROP, specify that penalty monies received by NERC during the 12 months ended June 30 are to be used in the subsequent budget year to offset assessments. In 2015, the NERC Board approved an updated Working Capital and Operating Reserves Policy that was approved by FERC. This updated policy allows NERC, with Board and FERC approval pursuant to Section of the ROP, to place penalty funds into a new Assessment Stabilization Reserve for use in future years to offset assessments. For the 2018 budget, NERC proposes to deposit $500,000 of penalty funds received during the 12 months ended June 30, 2017 into the Assessment Stabilization Reserve, resulting in a balance of $2,171,000 on January 1, NERC further proposes that none of those funds be used to offset assessments for the 2018 budget and that the balance held in the Assessment Stabilization Reserve be used for future assessment offsets. All penalties received during the 12 month period ended June 30, 2017 are detailed below, including the amount and date received. Allocation Method Penalty sanctions used to offset 2018 assessments have been allocated to the following statutory programs to reduce assessments: 1) Reliability Standards, 2) Compliance Assurance, 3) Compliance Analysis, Organization Registration and Certification, 4) Compliance Enforcement, 5) RASA, 6) Training, Education, and Personnel Certification, 7) Situation Awareness, 8) Event Analysis, 9) Performance Analysis, and 10) E-ISAC (including CRISP). Penalty sanctions are allocated based on the number of FTEs in the program divided by the aggregate total FTEs in the programs receiving the allocation. Penalty Sanctions Date Received Amount Received Penalties received between 7/1/2016 and 6/30/2017 May-17 $ 500,000 $ 500,000 Penalties received prior to 6/30/2016, held in the assessment stabilization reserve $ 1,671,000 Total penalties available on 1/1/2018 to offset assessments $ 2,171,000 Adjustments Total penalties released to offset assessments in the 2018 Budget $ - Total penalties held in Assessment Stabilization Reserve 12/31/2018 $ 2,171,000 86

90 Section B Supplemental Financial Information Table B-3 Outside Funding Outside Funding Breakdown By Program (Excludes Penalty Sanction) Budget 2017 Projection 2017 Budget 2018 Variance 2018 Budget v 2017 Budget Reliability Standards Workshops $ 105,000 $ 105,000 $ 50,000 $ (55,000) Interest Income Allocation 427 8,684 8,473 8,046 Total $ 105,427 $ 113,684 $ 58,473 $ (46,954) Compliance Analysis, Registration and Certification Interest Income Allocation $ 187 $ 5,363 $ 5,326 $ 5,139 Total $ 187 $ 5,363 $ 5,326 $ 5,139 Compliance Assurance Interest Income Allocation $ 386 $ 8,876 $ 10,410 $ 10,024 Total $ 386 $ 8,876 $ 10,410 $ 10,024 Compliance Enforcement Interest Income Allocation $ 327 $ 7,690 $ 6,294 $ 5,967 Total $ 327 $ 7,690 $ 6,294 $ 5,967 Reliability Assessment and System Analysis Services and Software $ 50,000 $ - $ - $ (50,000) Workshops 15,000 15,000 25,000 10,000 Interest Income Allocation 351 7,027 7,263 6,912 Total $ 65,351 $ 22,027 $ 32,263 $ (33,088) Performance Analysis Services and Software $ - $ 50,000 $ 50,000 $ 50,000 Interest Income Allocation 234 5,077 4,842 4,608 Total $ 234 $ 55,077 $ 54,842 $ 54,608 Training, Education, and Personnel Certification Testing Fees $ 671,900 $ 671,900 $ 540,000 $ (131,900) Certificate Renewals 650, , ,000 - Continuing Education Fees 600, , ,000 - Interest Income Allocation 175 3,721 3,026 2,851 Total $ 1,922,075 $ 1,925,621 $ 1,793,026 $ (129,049) Event Analysis Workshops $ 40,000 $ 115,300 $ 40,000 $ (0) Interest Income Allocation 281 6,211 5,810 5,529 Total $ 40,281 $ 121,511 $ 45,810 $ 5,529 Situation Awareness Interest Income Allocation $ 140 $ 3,328 $ 2,905 $ 2,765 Total $ 140 $ 3,328 $ 2,905 $ 2,765 E-ISAC Third Party Funding (CRISP) $ 6,990,447 $ 6,990,447 $ 7,144,431 $ 153,984 Workshops 70,000 70,000 70,000 (0) Interest Income Allocation ,136 17,152 16,661 Total $ 7,060,938 $ 7,076,583 $ 7,231,583 $ 170,645 Grand Total $ 9,195,347 $ 9,339,760 $ 9,240,931 $ 45,584 87

91 Section B Supplemental Financial Information Workshops The $45k decrease is due to one less Reliability Standards workshop being held in 2018, which is partially offset by an increase in RASA modeling workshop fees that are based on 2016 actuals. Interest Income Allocation The $69k increase is the result of higher anticipated interest rates in Services and Software The net change is $0, since $50k for PcGAR software was incorrectly budgeted in RASA in 2017 and is being reclassed to Performance Analysis in Testing Fees The $132k decrease is due to a reduction in the numbers of tests to be taken in Third Party Funding (CRISP) The $154k increase is due to the increase in NERC costs, which are funded equally by participants in CRISP and through assessments. Table B-4 Personnel Personnel Budget 2017 Projection 2017 Budget 2018 Variance 2018 Budget v 2017 Budget Variance % Salaries $ 30,073,438 $ 30,202,897 $ 31,020,351 $ 946, % Payroll Taxes 1,847,130 1,843,079 1,891,214 44, % Benefits 3,643,806 3,635,671 3,873, , % Retirement 3,076,956 3,019,391 3,148,316 71, % Total $ 38,641,331 $ 38,701,038 $ 39,932,918 $ 1,291, % FTEs % Cost per FTE Salaries $ 158,381 $ 158,854 $ 160,196 $ 1, % Payroll Taxes 9,728 9,694 9, % Benefits 19,190 19,122 20, % Retirement 16,205 15,881 16, % Total $ 203,504 $ 203,550 $ 206,222 $ 2, % Salaries - Total Salaries expense is comprised of base salaries, incentive compensation, deferred compensation, employment agency fees, and temporary office expenses. The 2018 budget for base salaries assumes a 3% increase over actual 2017 base salaries and is inclusive of market adjustments and promotions. The 2018 budget for incentive compensation is based on historical actuals and is comparable to prior years. The 2018 budgets for deferred compensation, employment agency fees, and temporary office expenses are generally consistent with Benefits are budgeted to increase 6.3% based on a 5% increase in health and dental premiums, as well as an increase in training expenses to support staff development. There have been no changes to NERC s retirement plans. Retirement expenses are increasing at a higher rate consistent with the 3% increase in base salaries. 88

92 Section B Supplemental Financial Information Table B-5 Meetings Meetings Budget 2017 Projection 2017 Budget 2018 Variance 2018 Budget v 2017 Budget Variance % Meetings $ 1,071,500 $ 1,176,500 $ 1,071,500 $ (0) 0.0% Travel 2,203,786 2,258,784 2,204, % Conference Calls 97, , ,600 22, % Total $ 3,372,886 $ 3,753,649 $ 3,395,100 $ 22, % The $22k increase in Conference Calls reflects an adjustment for WebEx expenses based on historical usage. Table B-6 Consultants and Contracts NOTE: This table has been replaced by Exhibit C Contractor and Consulting Costs, and is further discussed in the Executive Summary on page 15 Table B-7 Rent Office Rent Budget 2017 Projection 2017 Budget 2018 Variance 2018 Budget v 2017 Budget Variance % Office Rent $ 2,838,144 $ 2,838,144 $ 2,819,554 $ (18,590) -0.7% Maintenance 278, , ,250 (6,616) -2.4% Total $ 3,117,009 $ 3,117,009 $ 3,091,804 $ (25,205) -0.8% 89

93 Section B Supplemental Financial Information Table B-8 Office Costs Office Costs Budget 2017 Projection 2017 Budget 2018 Variance 2018 Budget v 2017 Budget Variance % Telephone $ 539,737 $ 522,362 $ 543,137 $ 3, % Telephone Answering Service 2,500 2,604 2, % Internet 383, , , % Office Supplies 194, , ,500 (3,500) -1.8% Computer Supplies & Maintenance % Computers 25,000 25,750 - (25,000) % Computer Supplies 101, , ,100 4, % Maintenance and Service Agreements 2,426,139 2,464,238 2,218,416 (207,723) -8.6% Software 122, , , , % Network Supplies - 3, % Subscription and Publications 180, , ,970 54, % Dues 49,316 52,631 66,411 17, % Postage 16,221 9,996 15,540 (681) -4.2% Express Shipping 28,216 25,973 26,992 (1,224) -4.3% Copying 110, , ,842 5, % Audio/Visual Lease - 163, , , % Computer Lease - 9,153 95,348 95, % Reports (362) % Stationary/Forms 2, (2,500) % Equipment Repair/Service Contracts 75, , ,497 57, % Bank Charges 25,000 25,896 25,000 (0) 0.0% Merchant Card Fees 77,500 76,678 86,100 8, % Total $ 4,359,340 $ 4,631,940 $ 4,978,084 $ 618, % Computers The $25k decrease is due to the decision to lease desktop computers in lieu of purchasing them in Maintenance and Service Agreements The $208k decrease is primarily the result of the following: $100k decrease in Compliance Assurance due the elimination of an audit tool; and $100k decrease in Finance in Accounting department due to the reclass of its budgeting and financial reporting software from this account to the Software account. Software The $118k increase is largely the result of a new analytic data software for the RASA department and the budgeting and financial reporting software for the Finance and Accounting department that were both reclassed from the Maintenance and Service Agreement account to this account. Subscriptions and Publications The $55k increase is due to higher fees for a research and advisory subscription, as well as a security tracking tool, both of which are in the Information Technology department. Dues The $17k increase primarily results from a new membership in an organization that allows NERC to partner with other entities in addressing strategic issues facing the electric industry. Audio/Visual Lease The $495k increase is the result of the reclass of costs related to the audio/visual equipment to this account from fixed assets. 90

94 Section B Supplemental Financial Information Computer Lease The $95k increase is due to the reclass of costs related to desktop computers and laptops from the Computer and fixed assets (capital) accounts, respectively, to this account due to the decision to lease desktop computers and laptops in lieu of purchasing them in Equipment Repair/Service Contracts $57k increase due to building security and HVAC needs in Table B-9 Professional Services Professional Services Budget 2017 Projection 2017 Budget 2018 Variance 2018 Budget v 2017 Budget Variance % Independent Trustee Fees $ 1,226,000 $ 1,226,000 $ 1,202,000 $ (24,000) -2.0% Trustee Search Fees 100, , , % Outside Legal 515, , ,000 12, % Lobbying 60,000 60,000 72,000 12, % Accounting and Auditing Fees 159, , ,908 4, % Insurance Commercial 230, , ,000 1, % Outside Services 178, , ,500 (4,500) -2.5% Total $ 2,468,135 $ 2,468,135 $ 2,469,408 $ 1, % The increase in Lobbying expense, budgeted in the Policy and External Affairs department, is due to an increase in the retainer of the firm that NERC uses. This expense is primarily related to NERC s monitoring of regulatory and legislative issues and responding to information requests related to these activities. 91

95 Section B Supplemental Financial Information Table B-10 Miscellaneous Miscellaneous Expenses Budget 2017 Projection 2017 Budget 2018 Variance 2018 Budget v 2017 Budget Variance % Miscellaneous Expense $ 6,500 $ 8,511 $ 7,000 $ % Employee Rewards and Recognition* 25,500 30,810 28,000 2, % Community Responsibility & Employee Engagement 5,000 3,430 4,500 (500) -10.0% Total $ 37,000 $ 42,750 $ 39,500 $ 2, % * Includes costs associated with year-end employee recognition event Table B-11 Other Non-Operating Expenses Other Non-Operating Expenses Budget 2017 Projection 2017 Budget 2018 Variance 2018 Budget v 2017 Budget Variance % Property Tax Expense $ 50,000 $ 52,442 $ 50,000 $ - 0.0% Interest Expense 56,725 57,422 65,000 8, % Total $ 106,725 $ 109,864 $ 115,000 $ 8, % Budgeted interest expense is calculated based on expected draws on the capital financing loan. Refer to Exhibit D Capital Financing on page 138 for more detailed information related to debt repayment and the interest expense calculation. Table B-12 Fixed Assets Fixed Assets Budget 2017 Projection 2017 Budget 2018 Variance 2018 Budget v 2017 Budget Variance % Depreciation $ (1,691,457) $ (1,781,346) $ (1,594,299) $ 97, % Computer & Software CapEx 2,572,000 2,446,669 2,501,000 (71,000) -2.8% Furniture & Fixtures CapEx Equipment CapEx 1,800,000 1,085,477 1,175,000 (625,000) -34.7% Leasehold Improvements Total $ 2,680,543 $ 1,750,800 $ 2,081,701 $ (598,842) -22.3% As discussed in the Executive Summary on page 15 and in the Section A Information Technology section beginning on page 74, expenditures for fixed assets, excluding the reversal of Depreciation expense, are budgeted to be $696k lower in 2018 compared to This decrease is primarily the result of leasing audio visual and certain computer equipment, resulting in a reduction of Fixed Assets and an increase in Office Costs in the 2018 budget. Table B Projections NOTE: Refer to the Executive Summary section on page 22 92

96 Section C Non-Statutory Activity NERC has no non-statutory activities. 93

97 Section D Supplemental Financial Statements [Statement of Financial Position will be provided in a subsequent draft] 94

98 NORTH AMERICAN ELECTRIC RELIABILITY COPRORATION Statutory Activities Statement of Activities, Fixed Asset Expenditures, and Change in Working Capital by Program 2018 Budget Statutory Total Reliability Standards Compliance Analysis, Organization Registration & Certification Compliance Assurance Compliance Enforcement Reliability Assessment and System Analysis Performance Analysis Personnel Certification Training and Continuing Education Event Analysis Situation Awareness Funding ERO Funding NERC Assessments $ 61,804,211 $ 7,359,153 $ 4,983,539 $ 8,703,882 $ 6,760,339 $ 7,401,514 $ 4,676,881 $ $ 1,370,091 $ 5,246,020 $ 3,922,541 $ 11,765,251 $ (385,000) $ $ $ $ Assessment Stabilization Reserve Penalties Total NERC Funding $ 61,804,211 $ 7,359,153 $ 4,983,539 $ 8,703,882 $ 6,760,339 $ 7,401,514 $ 4,676,881 $ $ 1,370,091 $ 5,246,020 $ 3,922,541 $ 11,765,251 $ (385,000) $ $ $ $ E ISAC (including CRISP) General and Administrative (Includes Executive and Gov't Relations) Legal and Regulatory Information Technology Human Resources Accounting and Finance Third Party Funding (CRISP) $ 7,144,431 $ $ $ $ $ $ $ $ $ $ $ 7,144,431 $ $ $ $ $ Testing Fees 1,790,000 1,190, ,000 Services & Software 50,000 50,000 Workshops 185,000 50,000 25,000 40,000 70,000 Interest 71,500 8,473 5,326 10,410 6,294 7,263 4,842 1,089 1,937 5,810 2,905 17,152 Miscellaneous Total Funding (A) $ 71,045,141 $ 7,417,626 $ 4,988,865 $ 8,714,292 $ 6,766,633 $ 7,433,777 $ 4,731,723 $ 1,191,089 $ 1,972,028 $ 5,291,830 $ 3,925,446 $ 18,996,833 $ (385,000) $ $ $ $ Expenses Personnel Expenses Salaries $ 31,020,351 $ 2,374,041 $ 1,513,647 $ 2,813,753 $ 1,797,735 $ 2,291,479 $ 1,371,401 $ 216,529 $ 486,791 $ 1,788,781 $ 902,263 $ 3,828,883 $ 3,253,002 $ 2,012,771 $ 3,286,945 $ 759,157 $ 2,323,175 Payroll Taxes 1,891, ,763 95, , , ,027 91,976 16,143 35, ,619 59, , , , ,192 28, ,435 Benefits 3,873, , , , , , ,205 40,533 54, , , , , , , , ,260 Retirement Costs 3,148, , , , , , ,756 24,462 54, , , , , , ,359 47, ,054 Total Personnel Expenses $ 39,932,918 $ 3,098,757 $ 1,971,889 $ 3,679,748 $ 2,282,819 $ 2,986,326 $ 1,768,339 $ 297,667 $ 632,413 $ 2,325,595 $ 1,207,329 $ 4,944,105 $ 3,921,559 $ 2,529,665 $ 4,274,554 $ 953,228 $ 3,058,925 Meeting Expenses Meetings $ 1,071,500 $ 105,000 $ 2,250 $ 200,000 $ 2,000 $ 121,000 $ 11,000 $ 32,000 $ 12,250 $ 81,500 $ 2,000 $ 127,000 $ 347,500 $ 6,000 $ 7,000 $ 10,000 $ 5,000 Travel 2,204, , , ,000 47, ,000 80,000 7,000 10, ,000 33, , ,000 55,000 72,000 5,000 75,000 Conference Calls 119, ,600 Total Meeting Expenses $ 3,395,100 $ 345,000 $ 152,750 $ 575,000 $ 49,500 $ 371,000 $ 91,000 $ 39,000 $ 22,250 $ 231,500 $ 35,000 $ 418,000 $ 710,500 $ 61,000 $ 198,600 $ 15,000 $ 80,000 Operating Expenses Consultants & Contracts $ 13,679,185 $ $ $ 50,000 $ $ 525,000 $ 572,030 $ 250,700 $ 348,200 $ $ 1,295,495 $ 7,346,794 $ 100,000 $ $ 2,123,966 $ 640,000 $ 427,000 Office Rent 3,091,804 3,091,804 Office Costs 4,978,084 49,796 21,684 37,063 19, ,889 57,812 46,121 71,848 43,786 41, , ,374 46,065 3,288,186 7, ,746 Professional Services 2,469, ,000 1,562, ,000 60, ,908 Miscellaneous 39, , , Depreciation 1,594,299 39, , , ,999 1,439 84,943 2,559 85, , ,592 Total Operating Expenses $ 25,852,280 $ 89,574 $ 22,184 $ 87,563 $ 124,674 $ 864,160 $ 774,341 $ 296,821 $ 421,987 $ 129,229 $ 1,340,451 $ 8,014,760 $ 5,615,745 $ 356,565 $ 6,082,244 $ 737,828 $ 894,154 Total Direct Expenses $ 69,180,297 $ 3,533,331 $ 2,146,823 $ 4,342,311 $ 2,456,993 $ 4,221,486 $ 2,633,680 $ 633,487 $ 1,076,650 $ 2,686,324 $ 2,582,781 $ 13,376,865 $ 10,247,804 $ 2,947,230 $ 10,555,398 $ 1,706,056 $ 4,033,079 Indirect Expenses $ 0 $ 3,859,068 $ 2,205,182 $ 4,300,105 $ 2,866,736 $ 3,307,773 $ 2,205,182 $ 496,166 $ 882,073 $ 2,646,218 $ 1,323,109 $ 5,512,955 $ (10,362,804) $ (2,947,230) $ (10,555,398) $ (1,706,056) $ (4,033,079) Other Non Operating Expenses $ 115,000 $ $ $ $ $ $ $ $ $ $ $ $ 115,000 $ $ $ $ Total Expenses (B) $ 69,295,297 $ 7,392,399 $ 4,352,005 $ 8,642,415 $ 5,323,729 $ 7,529,258 $ 4,838,862 $ 1,129,653 $ 1,958,723 $ 5,332,542 $ 3,905,890 $ 18,889,820 $ (0) $ 0 $ 0 $ 0 $ (0) Change in Assets $ 1,749,844 $ 25,226 $ 636,860 $ 71,876 $ 1,442,904 $ (95,482) $ (107,139) $ 61,436 $ 13,305 $ (40,711) $ 19,556 $ 107,013 $ (385,000) $ (0) $ (0) $ (0) $ 0 Fixed Assets Depreciation $ (1,594,299) $ (39,278) $ $ $ (105,014) $ (150,771) $ (143,999) $ $ (1,439) $ (84,943) $ (2,559) $ (85,136) $ (311,567) $ $ (669,592) $ $ Computer & Software CapEx 2,501, ,000 1,500, , ,000 Furniture & Fixtures CapEx Equipment CapEx 1,175,000 1,175,000 Leasehold Improvements Allocation of Fixed Assets 0 64,504 36,860 71,876 47,918 55,289 36,860 8,293 14,744 44,232 22,116 92, ,567 (806,408) Inc(Dec) in Fixed Assets (C) $ 2,081,701 $ 25,226 $ 636,860 $ 71,876 $ 1,442,904 $ (95,482) $ (107,139) $ 8,293 $ 13,305 $ (40,711) $ 19,556 $ 107,013 $ $ $ $ $ TOTAL BUDGET (=B+C) $ 71,376,999 $ 7,417,626 $ 4,988,865 $ 8,714,292 $ 6,766,633 $ 7,433,777 $ 4,731,723 $ 1,137,947 $ 1,972,028 $ 5,291,830 $ 3,925,446 $ 18,996,833 $ (0) $ 0 $ 0 $ 0 $ (0) TOTAL CHANGE IN WORKING CAPITAL (=A B C) $ (331,857) $ 0 $ (0) $ 0 $ 0 $ 0 $ 0 $ 53,143 $ (0) $ (0) $ 0 $ 0 $ (385,000) $ (0) $ (0) $ (0) $ 0 FTEs

99 Exhibit A Shared Assumptions and Key Focus Areas Shared Business Plan and Budget Assumptions Key Focus Areas for 2018 NERC and the eight Regional Entities (together the ERO Enterprise) are committed to a common operating model 1 that describes the characteristics of a highly efficient and effective Electric Reliability Organization (ERO) Enterprise. This operating model includes action items to address coordinated strategic and business planning, as well as performance monitoring processes across the enterprise. These processes remain transparent, with results reported on a quarterly basis to NERC s Corporate Governance and Human Resources Committee and the NERC Board of Trustees (Board) in support of the ERO Enterprise corporate oversight function. At its November 2016 meeting, the Board approved the ERO Enterprise Strategic Plan 2 with goals, objectives, and deliverables for the planning period. The strategic plan lays out five goals that the ERO Enterprise will focus on over the next three years. Those goals include (1) risk-responsive Reliability Standards, (2) objective and risk-informed compliance monitoring and enforcement, as well as organization certification and registration, (3) identification and mitigation of significant reliability risks, (4) identification and assessment of emerging reliability risks, and (5) effective and efficient ERO Enterprise operations. The plan also identifies a number of associated contributing activities to achieve the goals of the ERO Enterprise. There are also seven overarching performance metrics to assess the overall effectiveness of the ERO Enterprise in addressing risk to the Bulk Electric System (BES) and improving BES reliability in These metrics concentrate on (1) experiencing fewer, less severe events, (2) allowing no gaps in Reliability Standards and compliance monitoring, (3) foreseeing resource deficiencies, (4) preventing unauthorized physical or cyber security access that disrupts BES facilities, (5) reducing reliability risk from noncompliance, (6) decreasing risks in targeted areas, and (7) managing NERC operations in an efficient and effective manner. The following set of common assumptions has been developed to guide ERO Enterprise resource projections 3 for the period. Specifically, it supports the strategies heading into 2018 and establishes common assumptions, goals, and objectives as the ERO Enterprise begins the 2018 Business Plan and Budget (BP&B) cycle. Additionally, it outlines how these goals and objectives set the stage for periods beyond 2018, all in support of achieving the goals and objectives set forth in the Strategic Plan. Immediately following each list of assumptions for the respective program areas is guidance for the Regional Entities in drafting each of their 2018 BP&B narratives. NERC will describe these key focus areas in the text of its BP&B and expects each Regional Entity to do the same for the applicable delegated functions. The goal is to ensure that NERC and the Regional Entity BP&Bs reflect the collaboration within the ERO Enterprise regarding significant operations and key activities. Additionally, the text of the Regional Entities BP&Bs should continue to reflect resource allocation and support for ongoing delegated functions and activities. The relevant ERO Executive Management Group (ERO EMG) working groups are encouraged to discuss the common assumptions and key focus areas to address impacts to their area of operations. The Regional 1 ERO Enterprise Operating Model 2 ERO Enterprise Strategic Plan and Metrics NERC recognizes there are often unique factors that drive differences in each entity or organization s final determination of its resource needs and budget. Regional Entity-specific assumptions are stated in each Regional Entity s BP&B, as appropriate. 96

100 Exhibit A Shared Assumptions and Key Focus Areas Entity operating leads and corresponding NERC staff have collaborated on the content included herein. The results of this collaboration guide the initial drafting of the NERC and Regional Entity BP&B documents, streamline NERC s review of the initial drafts of the Regional Entity BP&Bs, and mitigate the need for material changes prior to (or after) posting of the draft BP&Bs. Similar to prior planning cycles, the specific resource needs and budgets of NERC and the Regional Entities will be publicly posted and made available on NERC s website for review. Each Regional Entity board approves its BP&B after an extensive review process that includes consideration of stakeholder input. In addition, the BP&Bs of NERC and each Regional Entity are approved in open session by NERC s Finance and Audit Committee and Board as part of the annual BP&B process. NERC s review of the Regional Entity BP&Bs will be primarily focused on ensuring alignment of activities with the Strategic Plan and adequacy of resources to support performance of delegated functions and key efforts. A 2018 BP&B schedule has been developed to identify important meeting dates, review periods, posting dates, etc. associated with the development and completion of the NERC and Regional Entity BP&Bs. The assumptions noted below will continue to be refined based on comments received from stakeholders and the ongoing work conducted by NERC and Regional Entity leadership regarding specific goals, objectives, and supporting activities over the planning period. LEGAL AND OPERATING FRAMEWORK NERC and the Regional Entities will continue to work under the existing regulatory framework governing the establishment and enforcement of Reliability Standards for the BES established by applicable governmental authorities in the U.S., provincial regulatory and/or governmental authorities in Canada, and portions of Mexico, as well as the authorizations contained in the Federal Energy Regulatory Commission s (FERC) Order approving NERC as the ERO. Additionally, as in prior years, the following responsibilities will continue: NERC enhancement of Regional Entity oversight for performance of their delegated functions. NERC and Regional Entity development of goals, measures, and reports to assess and evaluate the Regional Entities performance of their Regional Delegation Agreements (RDAs), NERC s Rules of Procedure 4 (ROP), the Compliance Monitoring and Enforcement Program (CMEP), FERC requirements, and directives that are in effect pursuant to Section 8(c) of the RDAs. NERC feedback and direction to the Regional Entities on performance improvements. NERC and Regional Entity collaboration to refine and revise processes and procedures to eliminate duplication, increase operational efficiencies, enhance ERO-wide consistency, and achieve measureable reliability outcomes. Regional Entity primary responsibility for day-to-day operations and interactions with registered entities. STAKEHOLDER PARTICIPATION NERC and the Regional Entities develop their BP&B s based upon the assumption of continued stakeholder participation in support of key program areas, while recognizing that stakeholder resource limitations may 4 NERC Rules of Procedure 97

101 Exhibit A Shared Assumptions and Key Focus Areas affect specific levels of participation in any given activity. The availability and adequacy of industry resource support will be evaluated on an ongoing basis. EXTERNAL FACTORS The performance and execution of BP&B s for each entity in the ERO Enterprise may be impacted by external factors. These factors include, but are not limited to, the following: FERC Orders, other applicable governmental authority actions, directives, audits, mitigation efforts, and performance assessments. Environmental Protection Agency (EPA) rules in the US and, likewise, provincial or Federal rules in Canada or Mexico that could potentially impact the reliability and/or operation of the BES. Other governmental agencies or departments that may issue rules, guidelines, orders, or directives that may impact the operation of the BES. The number and significance of changes within Balancing Authorities and Reliability Coordinators areas, prompting the need for associated re-certification and reliability plan assessments. The unanticipated rise in the rate and severity of entity violations. The unanticipated rise in the rate and severity of system events requiring formal investigations beyond historic volumes, and causal drivers of these events. New technologies and changes in resource or demand composition that require additional reliability studies and reliability risk analysis, including new techniques for conducting relevant assessments. Changes in applicable laws and regulations, including environmental laws and others. Priority risk activities identified by the Reliability Issues Steering Committee (RISC), committees of and reporting to the Board, and through other stakeholder input. The ability of stakeholders to support the pace and scope of the various activities while implementing the results of earlier efforts. COLLABORATION WITH THE TRADE ASSOCIATIONS AND FORUMS The activities of the North American Transmission Forum (NATF), North American Generator Forum (NAGF), and other forums and trade associations are expected to complement ERO Enterprise activities and mitigate incremental resource needs of NERC and Regional Entities in certain areas. NERC has a memorandum of understanding with the NATF and NAGF to ensure that the common objectives of each organization are achieved in the most efficient and effective manner. Increased collaboration between NERC and the NATF and NAGF is expected to continue. 98

102 Exhibit A Shared Assumptions and Key Focus Areas KEY ASSUMPTIONS AND FOCUS AREAS BY PROGRAM AREA 5 Reliability Standards Assumptions ( ) The number of continent-wide Reliability Standards development projects is expected to remain relatively stable, except as required to address any new FERC directives to create or modify Reliability Standards, or industry submittals of standard authorization requests. Continent-wide Reliability Standards projects will consist primarily of conducting enhanced periodic reviews on existing Reliability Standards to improve their content and quality, respond to identified risks to reliability (including those that may be identified through the implementation of risk-based Compliance Monitoring and Enforcement), and address FERC directives that may arise. This activity will require the allocation of technical resources from several internal NERC departments (e.g., Reliability Assessment and Performance Analysis (RAPA), Reliability Risk Management, Compliance Analysis and Certification, and Compliance Assurance) and support from across the ERO Enterprise. During the enhanced periodic review of Reliability Standards, any associated Regional Reliability Standards will be reviewed for potential incorporation as variances or as improvements to the continent-wide requirements. Regional and NERC Reliability Standards development processes may require modification to efficiently accomplish this task. Each Regional Entity will work with NERC and other Regional Entities as necessary on projects where there is a Regional Reliability Standard/variance. Regional Reliability Standards development activity is expected to remain low, driven by requests that the Regional Entity may receive or reliability issues that the Regional Entity may identify. In coordination with Standard Drafting Teams and consistent with current approaches, Regional Entities may support outreach during standard development and participate in the standard development activities as may be required to address reliability and stakeholder issues that may arise within their respective regions. Following FERC approval, NERC and the Regional Entities collectively will assist the transition of Reliability Standards to compliance monitoring and enforcement by supporting industry and auditor training or providing information regarding the intent of the Reliability Standard. The number of standard interpretations is expected to remain low. However, implementation guidance requests may increase. As noted in the assumptions for Information Technology (IT), Regional Entities will be asked to participate in teams to help develop application business requirements and test business functionality for ERO Enterprise applications projects. These teams will primarily be business area subject matter experts, not IT staff. The success of the Compliance Monitoring and Enforcement Process Tool project will be dependent on Regional Entity participation. When planning, Regional Entities should consider allocating resources at an adequate level of participation to support the success of this project. 5 These statements, which are generally organized by program area, are intended to help guide resource allocation decisionmaking in the development of the 2018 BP&Bs. 99

103 Key Focus Areas (2018) Exhibit A Shared Assumptions and Key Focus Areas Sustaining feedback loops, including audit and enforcement experience, continent-wide perspectives, lessons-learned, and events analysis for enhanced periodic reviews focused on conducting measured, in-depth reviews to improve Reliability Standards using the enhanced periodic review template. Incorporate Regional Reliability Standards into continent-wide Reliability Standards as the continent-wide Reliability Standards are reviewed through the enhanced periodic review process. Compliance Monitoring and Enforcement, and Organization Registration and Certification Compliance Assurance and Enforcement Assumptions ( ) The implementation of the risk-based CMEP requires the allocation of dedicated resources from NERC and the Regional Entities for both compliance and enforcement. Regional Entities will require resources to complete the Inherent Risk Assessments (IRAs) for all registered entities in In addition, Regional Entities will require resources to continuously update previously completed IRAs based on identified triggers and focus on creating compliance oversight plans that include compliance monitoring tools, the interval of compliance monitoring, and the Reliability Standards that are to be monitored. NERC and the Regional Entities will continue to evaluate business practices, implementation, and consistency within the risk-based compliance monitoring and enforcement program. NERC and the Regional Entities will continue to support the training and education requirements and guidelines necessary to meet the criteria set forth by the ERO Enterprise Compliance Monitoring and Enforcement Manual and the Competency Guide 6. Planning and operating Reliability Standard violations are expected to remain constant as most registered entities have been audited and, thus, have a greater understanding of compliance expectations. A modest increase may also occur as revisions of certain standards or new Reliability Standards become effective. Compliance personnel will need to continue support of the implementation of cyber-security Reliability Standards: NERC will continue Critical Infrastructure Protection (CIP) V5 training, coordination, and facilitation with the ERO Enterprise CIP auditors and the industry. ERO Enterprise CIP subject matter experts will support these activities to ensure appropriate knowledge and guidance is developed, understood by industry, and administered. The allocation of resources in 2018 should be responsive to continued implementation by registered entities of new versions of the CIP Reliability Standards, while recognizing that the risk-informed focus will be used. Additional resource allocation may be necessary for increased Physical Security compliance monitoring activities for CIP-014 and the compliance monitoring activities related to the Supply Chain Risk Management Reliability Standard (CIP-013). 6 ERO Enterprise Compliance Monitoring and Enforcement Manual and the Competency Guide 100

104 Exhibit A Shared Assumptions and Key Focus Areas ERO Enterprise CMEP staff, particularly staff with visibility into risks existing in the field, will provide feedback to the ERO Enterprise. This feedback may include information on risks seen in the field that are not addressed by a standard, as well as information on where a standard is too broad. ERO Enterprise CMEP staff will participate in the development of a solution, regardless of whether the risk is addressed through a new or modified Reliability Standard, or other means. ERO Enterprise CMEP staff will provide input for standards development teams on the risks seen in the field relating to a standard under development, as well as for how a Reliability Standard would be monitored. As noted in the assumptions for IT, Regional Entities will be asked to participate in teams to help develop application business requirements and to test business functionality for ERO Enterprise applications projects. These teams will primarily be business area subject matter experts, not IT staff. The success of the Compliance Monitoring and Enforcement Process Tool project will be dependent on Regional Entity participation. When planning, Regional Entities should consider allocating resources at an adequate level of participation to support the success of this project. NERC and the Regional Entities will continue to maintain the necessary resources to support the existing systems until ERO Enterprise application projects have been approved and implemented. Key Focus Areas (2018) Monitoring and management of compliance monitoring and enforcement metrics in support of ERO Enterprise s Strategic Plan and CMEP Oversight Program. Ongoing implementation and oversight of the risk-based CMEP, including IRAs, consideration of internal controls, and ensuring that Compliance Oversight Plans are addressing the relevant risks. Implementation and oversight of the CIP V5, CIP-013, and CIP-014 compliance monitoring programs, while recognizing that a risk-informed focus will be used. Continued ERO Enterprise-wide collaboration and implementation of consistent compliance monitoring and enforcement practices focused on higher reliability risks. Compliance Analysis, Certification, and Registration Assumptions ( ) Two central reforms have been identified as a result of the completion of the risk-based registration activity in 2015: 1. Modifications to the NERC Registry Criteria have been approved, including the elimination of three functional entities (Purchasing-Selling Entities, Interchange Authorities, and Load- Serving Entities), modifications to the threshold criteria for Distribution Providers, and alignment of five registration categories with the BES definition. 2. The NERC-led review panel, which vets requests for Deactivation or decisions not to register an entity that does not meet the Registry Criteria, as well as disputes regarding the application of the Registration Criteria and requests for a sub-set list of applicable Reliability Standards (which may specify the Requirements/sub-Requirements), has been incorporated into the rules. These reforms strengthen the registration process and are important milestones in NERC s approach to managing risks to reliability. Deployment and implementation of these revisions began in 2015, with continued work in 2017 and

105 Exhibit A Shared Assumptions and Key Focus Areas No further enhancements are anticipated to support the ongoing next phases of the risk-based registration activity. The results from the 2016 registration program review will result in modifications to the program in The recommendations from the Organization Registration Program review are summarized below and will be prioritized by the Organization Registration and Certification Group (ORCG) for work to be conducted in 2017 and 2018: NERC staff shall develop ERO Enterprise monitoring activities for The NERC-led review panel should compile a list of possible ROP enhancements related to the NERC-led review panel processes and procedures. NERC and the Regional Entities should develop and conduct outreach for industry to inform how the NERC-led review panel is conducted and how a submittal is processed. NERC and the Regional Entities should conduct an in-depth review on Joint Registration Organizations (JROs)/Coordinated Functional Registrations (CFRs). This may include how a JRO/CFR works, what the obligations are, different models implemented across the ERO Enterprise, forms/formats and communication, and examples of how to document the agreements. NERC should review its internal processes and procedures based on the recommendation from the independent audit. NERC and the Regional Entity staffs should work collaboratively with the ERO CMEP technology staff in reaching their milestones. NERC and the Regional Entities should draft a more defined procedure for its role in changes to BES Element status. NERC should review the website to 1) ensure the NERC Registration website is up to date, with documents in the appropriate locations and 2) ensure documents posted to the NERC Registration website are accurate. NERC should seek any ORCG input into ideas for clean-up and document migration. NERC and the Regional Entities should prioritize any current or future identified issues and focus to resolve the higher priority issues in a timely manner and report progress to the ORCG. The activities associated with the implementation of the BES definition have decreased and, therefore, no additional resource demands are expected in the registration area. However, with applications for Self-Determined Notifications no longer being accepted through the ERO Enterprise BESnet application, Regional Entities will need to validate, with NERC oversight, submittals to determine complete and proper application of the BES definition. Planned oversight activities for 2018 will be aligned with the ERO Enterprise Operating Model, which should not affect 2018 resource allocation and have little effect on overall NERC resource requirements. NERC understands that each Regional Entity will need to evaluate its individual resource needs and allocations. As noted in the assumptions for IT, Regional Entities will be asked to participate in teams to help develop application business requirements and to test business functionality for ERO Enterprise applications projects. These teams will primarily be business area subject matter experts, not IT staff. The success of the Entity Registration project, the Enterprise Reporting data warehouse project, and the Compliance Monitoring and Enforcement Process Tool project will be dependent 102

106 Exhibit A Shared Assumptions and Key Focus Areas on Regional Entity participation. When planning, Regional Entities should consider allocating resources at an adequate level of participation to support the success of these projects. Key Focus Areas (2018) Implementation of risk-based registration activities, collaborative development of a consistent registration program throughout the enterprise, and implementation of any registration program changes identified in the 2016 review, as listed above. Continued use of the NERC-led review panel, which may require four to six engagements per year that may require travel from each of the regional representatives. Reliability Assessment and Performance Analysis (RAPA) Reliability Assessment Assumptions ( ) NERC and the Regional Entities will continue to focus resources on high quality reliability assessments that address goals and their associated contributing activities identified in the ERO Enterprise s Strategic Plan for Goal 3 Identification and Mitigation of Significant Risks to Reliability and Goal 4 Identification and Assessment of Emerging Risks to Reliability. NERC and the Regional Entities will continue to support a common approach for NERC reliability assessments and ensure consistent evaluation, aligned with the ROP Section 800, Reliability Assessment Guidebook, and the Reliability Assessment Oversight Plan to be developed in NERC and the Regional Entities will advance data management strategies and analytical capabilities for identifying and determining reliability risks and conducting reliability assessments by: Integrating the analysis and measures of essential reliability services (ERS) into the Long-Term Reliability Assessment. The process encompasses new data collection and analysis approaches needed to address assessment objectives of identifying reliability issues due to a changing resource mix. Providing technical resources to examine transmission and deliverability studies and providing high-level evaluation for the Long-Term Reliability Assessment. Providing technical resources, advanced statistical analysis tools, objective expert input, and reliability leadership for the advancement of probabilistic analyses supporting the Long-Term Reliability Assessment. Supporting the NERC Enterprise Reporting Project to ensure Reliability Assessment data is integrated and supported by analytical reporting, data checking, and validation tools. NERC and the Regional Entities will provide technical expertise, research, and feedback to the industry, as well as provide foundational technical efforts that support reliability planning-related standards development. In addition to providing feedback, NERC will also solicit industry s help while leveraging any industry research. NERC and the Regional Entities may require contractor and consultant services to maintain continued support and technical expertise associated with activities listed in the above 103

107 Exhibit A Shared Assumptions and Key Focus Areas assumptions with supporting special assessment, scenario, or other technical research efforts. This could potentially impact both NERC and Regional Entity resource allocation including: Contractor services may be necessary to support special assessment analyses (e.g., EPA 111(d) evaluation or ERS), scenario analyses (e.g., polar vortex-like severe event analyses and gaselectric interdependence), and other technical research efforts (e.g., similar to geomagnetic disturbances (GMDs) and FAC-003 Vegetation Management). Contractor services may be needed to support research into GMDs and their impact on BPS operations (see FERC Order 830). Contractor services may be needed to support increase in data analysis to support ERS measures, CPS1/CPS2 control performance, and frequency trending. As noted in the assumptions for IT, Regional Entities will be asked to participate in teams to help develop application business requirements and to test business functionality for ERO Enterprise applications projects. These teams will primarily be business area subject matter experts, not IT staff. The success of the Enterprise Reporting data warehouse project and the Compliance Monitoring and Enforcement Process Tool project will be dependent on Regional Entity participation. When planning, Regional Entities should consider allocating resources at an adequate level of participation to support the success of this projects. Key Focus Areas (2018) NERC and the Regions will prioritize their work products according to the ERO Reliability Risk Priorities 7 developed by the RISC, including: 1) Changing Resource Mix (Risk Profile #1), 2) BPS Planning (Risk Profile #2), and 3) Resource Adequacy and Performance (Risk Profile #3). Ongoing support for the Planning and Operating Committees and associated subcommittees, working groups, and task forces. Develop Reliability Guidelines and Technical Reference Documents based on priority and risk. Produce three required reliability assessments reflective of the common approach developed for NERC reliability assessments to ensure consistent treatment of resource and reliability evaluations: 1) Long-Term Reliability Assessment (incorporated probabilistic assessment), 2) Summer Reliability Assessment, and 3) Winter Reliability Assessment. Conduct special reliability assessments, as necessary, directed at high priority risks identified by RISC. Performance Analysis Assumptions ( ) Ongoing support for the technical committees and associated subcommittees, working groups, and task forces. NERC and the Regional Entities will continue to focus resources on system insights from high quality performance analysis, including: Development and implementation of expanded and enhanced enterprise-based data collection and analysis systems, and capabilities for performance analyses. This area includes Transmission Availability Data System (TADS), Generating Availability Data System (GADS), 7 ERO Reliability Risk Priorities 104

108 Exhibit A Shared Assumptions and Key Focus Areas Demand Response Availability Data System (DADS), Event Analysis, Alerts, substation equipment failure, and protection systems misoperations data. o Support of the integration of information systems for assessments and associated data requirements (in support of data cleansing, blending, and validation). o Maturing and developing interconnection-wide analysis groups to support the assessment of interconnection-wide risks, such as frequency response. Providing technical resources, analytical tools, and expertise to perform analyses as needed, including supporting and identifying risk priorities for standards development, compliance, and enforcement activities. Support the NERC Enterprise Reporting Project to ensure Performance Analysis data is integrated into consolidated system and supported by analytical reporting tools, as well as feedback loops to other parts of the ERO Enterprise such as compliance, standards, enforcement, etc. As noted in the assumptions for IT, Regional Entities will be asked to participate in teams to help develop application business requirements and to test business functionality for ERO Enterprise applications projects. These teams will primarily be business area subject matter experts, not IT staff. The success of the Enterprise Reporting data warehouse project will be dependent on Regional Entity participation. When planning, Regional Entities should consider allocating resources at an adequate level of participation to support the success of this project. Key Focus Areas (2018) Ongoing support for the technical committees and associated subcommittees, working groups, and task forces. High quality performance analysis, including: Development and implementation of expanded and enhanced enterprise-based data collection and analysis systems, and capabilities for performance analyses. This area includes TADS, GADS, DADS, Event Analysis, Alerts, substation equipment failure, and protection system misoperations data. Support of the integration of RAPA information systems for assessments and associated data requirements, supporting delivery of high-quality reports (e.g., long-term, short-term, special or scenario assessments, and State of Reliability Report). Providing technical resources and expertise to perform analyses as needed, including supporting and identifying risk priorities for standards development, compliance, and enforcement activities and feedback loops to other parts of the ERO Enterprise, such as compliance, standards, enforcement, etc. System Analysis Assumptions ( ) NERC and the Regions are advancing their analytical capabilities to assess and report on the reliability of the BPS. Additionally, newer and maturing technologies, such as synchro-phasor measurement unit (PMU) technology, are enabling innovative approaches for event analysis, power system analysis, and model validation. NERC and the Regions are uniquely situated to perform analyses that require a wide-area view of the interconnections, as well as supporting 105

109 Exhibit A Shared Assumptions and Key Focus Areas industry in advancing software and analytical capabilities where appropriate. Support and leadership to the System Analysis Subcommittee and any of the subcommittees, working groups, and task forces will continue. NERC will advocate to improve existing commercially available software capabilities and perform power system analysis that create a more profound understanding of system behavior (e.g., interarea oscillations, frequency response, system strength, voltage/reactive performance, signal processing, and signature detection). NERC will provide direction and oversight of the interconnection case-building designees in support of interconnection model building and wide-area system analysis: Mature and develop interconnection-wide analysis groups to support the assessment of interconnection-wide risks: o Conduct special reliability assessments based on recommendation from load modeling task force modeling to capture the impact of composite load modeling on transmission and distribution system--for example, Fault Induced Delayed Voltage Recovery. o Require powerflow, short circuit, and stability analysis tools and objective expert input for transmission adequacy and deliverability assessments and studies. NERC and the Regional Entities resources (through the case building designee agreements) will support the Planning Coordinators development of long-term sustainable interconnection-wide powerflow, short circuit, and dynamics cases that exhibit the accuracy and fidelity reflecting actual BES reliability performance and dynamic conditions. NERC and the Regional Entities will advance modeling improvement capabilities to ensure the power system planning and operation models closely resemble actual operating conditions. Perform periodic model validation against measured quantities and operational practices of the power system. Perform case quality and fidelity assessment on interconnection wide models: o Case data quality. o Case performance fidelity. Drive the advancement and use of dynamic load modeling on an interconnection-wide basis. o Formulate and guide the ERO Enterprise vision and associated activities to promote the advancement and use of dynamic load models and modeling practices. o Establish guidelines and technical reference documents related to dynamic load modeling practices, including explanations of existing dynamic load models and their structure, data sets, and parameter derivation. o Serve as the industry focal point and open forum for discussing dynamic load modeling practices for system planning and operations studies. Provide industry guidance and support to entities seeking direction on dynamic load modeling across North America. Drive the advancement and use of inverter-based modeling on interconnection wide basis. o Establish guidelines and technical reference documents related to inverter-based resource modeling on transmission and distribution system. o The recommended modeling practices for utility scale renewable energy resources using new inverter based technology. 106

110 Exhibit A Shared Assumptions and Key Focus Areas NERC will support the maintenance of the BESnet application and manage processing of the BES Exception Requests (ERs), including technical validation of review and approval of Regional ERs, periodic reviews of network changes affecting BES Exception determinations, recertification of previously approved BES ER, as well as requests for certain registration and certification reviews. The Regional Entities will continue to process BES ERs per guidelines established in the ROP. Recertification for exceptions begins in NERC and the Regional Entities will work collaboratively to enhance the ERO Enterprise s capability for event and forensic analysis, including: Development of a process to ensure the compilation and creation of steady state, short circuit, and dynamic simulation model cases for use in the investigation and analysis of major power system disturbance events. Evaluation of event disturbances using phasor measurements and other methods to assess sufficiency of data and models. NERC will provide technical expertise, research, and feedback to the industry, as well as foundational technical efforts that support the key reliability planning-related standards development. In addition to providing feedback, NERC will also solicit industry s help by using resources and leveraging any research that has been done by the industry. NERC and the Regional Entities may require contractor and consultant services to maintain continued support and technical expertise associated with activities listed in the above assumptions, supporting special assessment, scenario analysis, or other technical efforts, potentially impacting both NERC and Regional Entity resource allocation, including: If significant events occur, contractor services may be required to support wide-area system analyses and root cause evaluations. Contractor services may be necessary to support special reliability assessment analyses (e.g., Inertia Response and Primary Frequency Response Analysis, Voltage and reactive performance study, and Inter-Area Oscillation Analysis). Contractor services are needed to support Dynamic model developments (e.g., Composite Load Modeling, utility scale renewable energy modeling and distributed energy resources). For 2018, the Load Modeling Task Force is requesting load model testing (approximately $100k). Contractor services are needed to support the Synchronized Measurement Subcommittee with a PMU-based assessment (approximately $100k). As noted in the assumptions for IT, Regional Entities will be asked to participate in teams to help develop application business requirements and to test business functionality for ERO Enterprise applications projects. These teams will primarily be business area subject matter experts, not IT staff. The success of the Enterprise Reporting data warehouse project will be dependent on Regional Entity participation. When planning, Regional Entities should consider allocating resources at an adequate level of participation to support the success of this project. Key Focus Areas (2018) Stakeholder and Committee Support - Ongoing support for the Planning and Operating Committees, and associated subcommittees, working groups, and task forces. 107

111 Exhibit A Shared Assumptions and Key Focus Areas ERO Enterprise Technical Support - Ongoing support for BES exception processing, Risk-Based Registration, Standards, and Compliance support. Modeling Improvement Initiatives - Perform periodic model validation against measured quantities and event models to ensure case quality and fidelity and also case creation for event analysis. Power System Analysis - Develop technical analyses in key reliability areas, resulting in technically accurate and comprehensive reports addressing areas of concern (e.g., frequency response, short circuit strength, inter-area oscillation, distributed energy resource and load composition changes, etc.) to evaluate the characteristics and performance of the BPS with changes to the resource mix and integration of new technologies: Synchrophasor technology - Collect strategically selected PMU data in near real-time for improved situational awareness and monitoring, and to gather larger PMU datasets for advanced data analytics and modeling improvements. Expand use of synchrophasor technology for power plant model verification and compliance with MOD-026/-027 standards. Oscillation analysis - Broaden understanding of inter-area, local, and forced oscillations in all interconnections; use wide-area synchrophasor data to provide industry with better understanding of phenomena, available tools, and findings. Load and distributed resource modeling - Drive education of dynamic load modeling and development of improved dynamic load models; supporting compliance with TPL Support study and policy development related to end-use load behavior; advocate for gridfriendly load response. Frequency response analysis and vision - Meet regulatory requirements per BAL-003-1; exploratory understanding of frequency response; support interconnection-wide studies of frequency response. Case quality metrics, model validation and improvement - Improve case quality and robustness, support industry developments for MOD-033 tools and processes feedback loop with MOD-032 designees. Proactively seek to address deficiencies in interconnection-wide models and eliminate incessant problems. Ensure models can recreate plant behavior. Event Forensics - Support NERC Event Analysis in event of major grid disturbance; simulation and data analysis expertise across multiple platforms. System Strength & Reactive/Voltage Performance Analysis - Support ERS measure with advanced studies of potential phenomena under future end states; perform assessment of short circuit ratio study and implications based on regional/local studies. Geomagnetic Disturbances - Conduct research on geomagnetic disturbances to address FERC Order 830 (three to four year research plan). Technical Support, Standard Support, Implementation, and Outreach - Provide technical expertise and unique insights to the industry. The department will also develop white papers, technical reports, and reference documents, as needed, to address emerging issues and industry concerns related to system planning and operations. The department will also develop and produce Reliability Guidelines for the Planning and Operating Committees. In addition to providing feedback, NERC will also solicit industry s help by using research work that has been done by the industry and academia. 2-3 in-person workshops. 108

112 Exhibit A Shared Assumptions and Key Focus Areas Participation at industry technical groups, such as Institute of Electrical and Electronics Engineers (IEEE), North American SynchroPhasor Initiative (NASPI), International Council on Large Electric Systems (CIGRE), Power Systems Engineering Research Center (PSERC), etc., as needed. Advanced Software Capabilities - In order to conduct analysis and produce results in a timely manner, additional and improved data collection, data management, and analytical tools will be required. Robust analytical tools will increase the effectiveness of NERC staff to functionally correlate disparate data sources to ensure full-scope analyses and assessments of situations relevant to reliability risks are performed more broadly than in historical NERC analyses and assessments. Using state of the art software and technology is crucial to effective analysis especially considering the size of the North American electric footprint. Situation Awareness and Infrastructure Security (including Event Analysis) Situation Awareness Assumptions ( ) Ongoing support for the technical committees and associated subcommittees, working groups, and task forces. Regional Entity involvement is expected to remain at current levels with no additional resources required from the Regional Entities. Registered entity participation in the ERO Enterprise Event Analysis Process, which involves active participation by Regional Entity staffs, will continue at or above current levels through NERC will continue to require the software application known as Situational Awareness for FERC, NERC, and Regional Entities, Version 2 (SAFNRv2) for situation awareness, and The Event Analysis Management System (TEAMS) for Events Analysis. The allocation of additional resource investments is expected to maintain the capabilities of SAFNRv2 throughout the planning period. Any such investments will be NERC funded and not result in an allocation of cost to the Regional Entities. Regional Entities will continue to budget for event analysis and situational awareness activities based on their respective Region s historical workload, as they did in the past. Some Regional Entities will continue to allocate resources as part of the activities accounted for under their RAPA program and should clearly delineate where the activities resources are budgeted. Regional Entities will support critical infrastructure security activities in the context of situation awareness, using those designated resources, unless specifically budgeted and managed elsewhere. As noted in the assumptions for IT, Regional Entities will be asked to participate in teams to help develop application business requirements and to test business functionality for ERO Enterprise applications projects. These teams will primarily be business area subject matter experts, not IT staff. The success of the Enterprise Reporting data warehouse project will be dependent on Regional Entity participation. When planning, Regional Entities should consider allocating resources at an adequate level of participation to support the success of this project. 109

113 Exhibit A Shared Assumptions and Key Focus Areas Key Focus Areas (2018) Ongoing support for the technical committees and associated subcommittees, working groups, and task forces. Support for ERO Enterprise data collection and analysis, as well as the Enterprise Reporting Project designed to transfer the data to an integrated platform. Support for critical infrastructure security by promoting rapid and appropriate sharing of situational awareness information regarding security occurrences. Analysis of significant events to identify gaps in standards, compliance effectiveness, registration, and risk controls effectiveness. Work on overcoming barriers to the timely release of BES and security reports to industry through a secure portal. Providing of lessons learned and recommendations from events and identified risks. Enhancement of risk analysis capabilities by integrating risk data sources, such as event analysis, TADS, GADS, and protection system misoperations into situation awareness assessments. Participation as appropriate in periodic wide-area security exercises (e.g., GridEx, Monitoring and Situation Awareness Workshop, NERC HP Conference, feedback loops to other parts of the ERO Enterprise such as compliance, standards, enforcement, etc.). Event Analysis Assumptions ( ) Ongoing support for the technical committees and associated subcommittees, working groups, and task forces. Regional Entity involvement is expected to remain at current levels with no additional resources required from the Regional Entities. Registered entity participation in the ERO Enterprise Event Analysis Process, which involves active participation by Regional Entity staffs, will continue at or above current levels through Regional Entities will continue to budget for event analysis and situational awareness activities based on their respective Region s historical workload, as they did in the past. Some Regional Entities will continue to allocate resources as part of the activities accounted for under their RAPA program and should clearly delineate where the activities resources are budgeted. Regional Entities will support critical infrastructure security activities in the context of situation awareness, using those designated resources, unless specifically budgeted and managed elsewhere. As noted in the assumptions for IT, Regional Entities will be asked to participate in teams to help develop application business requirements and to test business functionality for ERO Enterprise applications projects. These teams will primarily be business area subject matter experts, not IT staff. The success of the Enterprise Reporting data warehouse project will be dependent on Regional Entity participation. When planning, Regional Entities should consider allocating resources at an adequate level of participation to support the success of this project. Key Focus Areas (2018) Ongoing support for the technical committees and associated subcommittees, working groups, and task forces. 110

114 Exhibit A Shared Assumptions and Key Focus Areas Support for ERO Enterprise data collection and analysis, as well as the Enterprise Reporting Project designed to transfer the data to an integrated platform. Support for critical infrastructure security by promoting rapid and appropriate sharing of situational awareness information regarding security occurrences. Analysis of significant events to identify gaps in standards, compliance monitoring effectiveness, registration, and risk controls effectiveness. Work on overcoming barriers to the timely release of BES reports to industry through a secure portal. Providing of lessons-learned and recommendations from events and identified risks. Continue to provide industry leadership in the analysis, understanding, and prevention of human error and improved human performance with regards to increased BPS reliability. Enhancement of risk analysis capabilities by integrating risk data sources, such as event analysis, TADS, GADS, and relay misoperations. Participation as appropriate in periodic wide-area security exercises (e.g., GridEx and feedback loops to other parts of the ERO Enterprise such as compliance, standards, enforcement, etc.). Electricity Information Sharing and Analysis Center (E-ISAC) Assumptions ( ) NERC will continue to fund, operate, and maintain the E-ISAC in performing its mission to reduce cyber and physical security risk to the electricity sector across North America by providing unique insights, leadership, and coordination. Threat information and mitigation best practices will be shared across the community, emphasizing reliability and resilience-related physical and cyber security considerations with a continued focus on potential impacts to an evolving footprint of essential reliability services. The stakeholder community served by the E-ISAC includes the ERO Enterprise and NERC registered entities and importantly extends into distribution system asset owners and operators; local, state, provincial, and federal (US, Canada, Mexico) government departments and agencies with electricity policy, information sharing, intelligence, research and development, and law enforcement roles, and additional cross-sector organizations and supply chain vendors. All information sharing with these stakeholders will continue to be subject to the E-ISAC Code of Conduct. 8 E-ISAC budgeting for FTE staff and programs will need to increase during this period to improve security analysis and stakeholder support. With additional staff, there will be an increased budget requirement for staff security training, as well as travel within North America to utilities and stakeholder meetings for threat briefings, training, and exercises. Staff will provide subject matter expertise and analysis for physical and cyber security information requests from stakeholders, including risk-informing ERO Enterprise standards functions subject to Code of Conduct limitations. Programs and capabilities to mature and enhance include: E-ISAC Portal as a Platform data analysis center functionality and stakeholder communication tools and meeting protocols for 8 E-ISAC Code of Conduct 111

115 Exhibit A Shared Assumptions and Key Focus Areas rapid information sharing. Programs, such as the Cybersecurity Risk Information Sharing Program (CRISP) and other Department of Energy initiatives, will continue to apply supplementary participant funding approaches with no increased cost to the Regional Entities, except as elective participants. NERC will continue to fund and, through the E-ISAC, conduct security exercises and training to include the biennial Grid Security Exercise (GridEx) program, as well as train the trainer Cybersecurity Risk Assessment Program events, and timely emergent issues risk mitigation training (e.g., Ukraine, Internet of Things, etc.) with no increased cost to the Regional Entities, other than travel expenses for in-person meetings and briefings. NERC will continue to fund E-ISAC conducted security-related meetings and threat briefs to include the Grid Security Conference (GridSecCon) as an annual event, monthly conference calls, and other regular or emergent issue threat briefings as required with coordination from appropriate government entities. Other than funding registration fees and travel expenses for individual attendees from their Regional Entity, no Regional Entity funding is anticipated. Key Focus Areas (2018) Stakeholders: The E-ISAC will continue to add value for stakeholders through member engagement, information sharing and analysis, and function as a coordinating hub within the electricity subsector for the ERO Enterprise and the Electricity Subsector Coordinating Council (ESCC) Playbook communications with industry and government. The E-ISAC will work closely with emerging, resource-dedicated Regional Entity security functions 9 that are rigorously separated from compliance and enforcement areas. The ESCC Member Executive Committee will provide industry guidance to help the E-ISAC improve. E-ISAC staff will continue to interface with important security-related stakeholder groups (such as the Critical Infrastructure Protection Committee) as subject matter experts and continue developing relevant security metrics. Staff: Resourcing requirements indicate appropriate expansion for additional cyber and physical analytic staff to fulfill value delivery elements of this plan. Additionally, adequate resourcing is planned to ensure NERC support for standard, recurring professional security training for staff, as well as North American travel to fulfill the E-ISAC mission. Systems and Programs: The centerpiece of E-ISAC collaboration with members is the Portal, which will undergo an important upgrade in 2017 into a much more capable platform model to support and coordinate key initiatives, including: improved collaboration capability, data analysis center functionality, improved stakeholder management, malware drop box, and more. In 2018, lessons learned from GridEx IV (November 2017) will also be available to drive further enhancements of the Portal platform. CRISP and other key programs, in partnership with DOE, will continue to support expanded membership engagement and analytic capability advancements. 9 Regional Entities should designate in writing the person(s) who will be separate from ERO CMEP functions to provide securityfocused point(s) of contact to the E-ISAC who will receive access to security products on the portal. A security designation template is available from the E-ISAC. 112

116 Exhibit A Shared Assumptions and Key Focus Areas Training, Education, and Continuing Education Assumptions ( ) NERC will continue to fund the ERO Enterprise Learning Portal (EELP). NERC will work with the Regional Entities to consolidate learning resources and promote better coordination, planning, delivery, and management of learning activities across the ERO Enterprise in concert with Regionspecific learning activities/requirements. Regional Entities will allocate resources to meet their statutory and delegation agreement requirements. The Regional Entities, in collaboration with NERC, will jointly contribute to the assessment and determination of ERO Enterprise learning and outreach needs. This includes advocating flexibility in the approach between Regional Entities and anticipating areas of support for their staff and stakeholders regarding the ERO Enterprise s programs. CMEP staff training and education are expected to remain a focal point for the ERO Enterprise. NERC will continue to lead the development of a compliance learning curriculum with assistance of qualified subject matter experts from the Regional Entities, Operational Leadership Team (OLT) working groups, and incorporation of outside expertise/services. Much of the financial cost for the Regional Entities ERO Enterprise learning development support is through the functional program support cycle. However, Regional Entities should continue to budget travel funds for attendance at development meetings that result from special requirements as business needs are clarified throughout the year. These funds may also support attendance at future joint ERO Enterprise training meetings/workshops. These potential meetings will likely not exceed three in a year with a requirement for one or two persons attending at any one time. Regional Entities must allocate resources to address compliance and enforcement staff learning needs that are associated with the implementation of the risk-informed CMEP. Contractor and consultant services are imperative to the development, delivery and technical support load anticipated for ERO Enterprise learning needs/activities. The NERC Continuing Education Program is expected to remain at steady state in support of system operator certification. Potential expansion to other functional programs would be known well in advance and additional funding will be allocated to support the expansion. Key Focus Areas (2018) Participate in the ERO Enterprise staff learning development process through the OLT working groups, NERC functional area program leaders, and coordinating/working meetings. This requires commitment of resources, subject-matter expertise, and trainers in identifying learning needs, content development/coordination, product review/feedback, and delivery. Provide and maintain administrative support to the EELP. This includes maintaining the Regional Entity-specific portion of the system and coordinating/collaborating with the NERC administrator in improvement and operation of the system for the ERO Enterprise. Facilitate ERO Enterprise learning by analyzing events, communicating lessons learned, tracking recommendations, and supporting the use of the EELP for learning scheduling, delivery, and records management. Support coordination, planning, delivery, and management of learning efforts across the ERO Enterprise in concert with Region-specific training, education, and outreach needs/activities. 113

117 Exhibit A Shared Assumptions and Key Focus Areas In collaboration with NERC program leaders, support learning development efforts for ERO Enterprise staff and stakeholders as identified/needed in the course of program management activities, development, and outreach. Personnel Certification Assumptions ( ) NERC will continue to provide required support and leadership for the Personnel Certification Governance Committee (PCGC) and working groups serving the PCGC. The Personnel Certification program is expected to remain at a steady state with no additional resources required from the Regional Entities. Key Focus Areas (2018) Continue to update System Operator Certification Exam Item Bank to ensure relevance to current Reliability Standards and promote reliability of the BPS. Develop Exam Skills Assessment Strategy to better assess the skills and knowledge of System Operators. Evaluate Credential Review and Rationalization to maintain credential. Information Technology Assumptions ( ) NERC and the Regional Entities will work collaboratively to refine existing strategies and governance and procurement practices applicable to the development, operation, and maintenance of enterprise architecture, including software and data systems supporting both NERC and Regional Entity operations. NERC s BP&B will include ongoing funding support for the development, operation, and maintenance of ERO Technology Leadership Team (TLT) and ERO EMG-approved enterprise applications. Enterprise application funding in any given year will be subject to the budget and funding limits set forth in NERC s approved BP&B. Regional Entities should include appropriate funding for applications and supporting systems designed to satisfy Regional business needs. Regional Entities may be required to provide or augment business teams to help develop application business requirements and to test business functionality within the ERO Enterprise applications, such as the CMEP Technology Program Steering Committee. Ongoing investments will be required to develop, implement, and maintain enhancements to the NERC and Regional Entity websites, ERO Enterprise applications, and ERO Enterprise data repositories, which are required to improve access to information and data. NERC and the Regional Entities will separately fund any enhancements to their own websites. Key Focus Areas (2018) Following a disciplined process with appropriate ERO TLT approval, along with budgetary controls, the ERO Enterprise Project Management Office will deliver agreed upon ERO Enterprise IT 114

118 Exhibit A Shared Assumptions and Key Focus Areas applications designed to be used by NERC, the Regional Entities and, in some cases, registered entities. To ensure close coordination, collaboration, and efficiency, to the extent the agreed upon applications are in progress or widely available, NERC and the Regional Entities will not build or duplicate ERO Enterprise application functionality. NERC s BP&B will include ongoing funding support for the development, operation, and maintenance of NERC and Regional Entity approved enterprise applications. Enterprise application funding in any given year will be subject to the budget and funding limits set forth in NERC s approved BP&B. When no ERO Enterprise applications are available to satisfy the requirement, Regional Entities should provide a description of the maintenance and capital investment in software required in performance of their delegated functions. The NERC IT budget does not supplant Regional Entity need for IT expenditures for specific regional projects. Key focus area projects include: Enhancing collaboration and information sharing by leveraging Microsoft s SharePoint platform. At the first phase ( ) of the project, NERC is scheduled to deliver a Document Management system and NERC Intranet interface. The second phase includes delivery of enhancements to NERC s public facing website. The third phase is scheduled for and will deliver NERC extranet, as well as replace document collaboration with Microsoft s SharePoint collaboration System. Improving entity specific communication and information sharing across the ERO Enterprise. Plans include a new intelligent announcements and alert solution to be delivered in Implementing new Enterprise-wide support tools for CMEP. Its first phase to deliver a centralized entity registration solution is scheduled for The second phase enables NERC Reliability Standards to be used as shared data and is scheduled for The third phase delivering new solutions and retiring current solutions that support the CMEP is scheduled for Consolidating data collected by NERC and making it available for analysis by authorized organizations. The build out of an ERO Enterprise Data Warehouse is currently underway. Additional data will be extracted, transformed, and loaded during Data to be loaded includes generation, transmission, events, misoperations, and compliance data. ERO Enterprise-wide Risk Management Assumptions ( ) A common ERO Enterprise risk management framework commenced in 2014 to focus on identifying, assessing, prioritizing, and mitigating risks associated with the performance of both NERC and the Regional Entities. This multi-year activity is progressing as expected and will reach steady state by NERC s Director of Internal Audit and Corporate Risk Management is responsible for the overall development of this framework, with the approval of the ERO Regional Executives and under the oversight of NERC s Enterprise-wide Risk Committee. NERC and the Regional Entities will continue to devote resources to implement this framework. The results will serve as an input into NERC s future audit plans, which are reviewed and approved 115

119 Exhibit A Shared Assumptions and Key Focus Areas by the NERC Board of Trustees Enterprise Risk Management Committee. Regional Entities may add risk management and internal control resources as needed. Key Focus Areas (2018) NERC and Regional Entities key focus areas include continued refinement, validation, and prioritization of inherent and residual risks; greater precision in the identification of risk mitigation activities and internal controls; and enhanced consolidated results for ERO EMG review and approval. 116

120 Exhibit B Application of NERC Section 215 Criteria I. Introduction DISCUSSION OF HOW THE NERC MAJOR ACTIVITIES IN THE 2018 BUSINESS PLAN AND BUDGET MEET THE NERC WRITTEN CRITERIA FOR DETERMINING WHETHER A RELIABILITY ACTIVITY IS ELIGIBLE TO BE FUNDED UNDER FEDERAL POWER ACT SECTION 215 This Exhibit discusses how the major activities in NERC s 2018 Business Plan and Budget meet the NERC written criteria for determining whether a reliability activity is eligible to be funded under 215 of the Federal Power Act ( FPA 215 ). This Exhibit is intended to satisfy Recommendation No. 38 resulting from the financial performance of NERC conducted by the Commission s Division of Audits ( DA ) in and adopted by the Commission in its November 2, 2012 order on NERC s 2013 Business Plan and Budget. 1 NERC submitted the written criteria to the Commission in a compliance filing dated February 21, 2013 in Docket No. FA The Commission approved the NERC written criteria, with modifications, in an order issued in that docket on April 18, The NERC written criteria as used in this Exhibit incorporate the modifications specified in the Compliance Order. 4 II. Reliability Standards Program 2018 Major Activities The major activities of the Reliability Standards Program are described at pages of the 2018 Business Plan and Budget. The Reliability Standards Program carries out the ERO s responsibility to develop, adopt, obtain approval of, and modify as and when appropriate, mandatory Reliability Standards for the reliable planning, operation, and critical infrastructure protection of the North American BES. The major activity areas for this program include (1) providing project management and leadership to the reliability standard development process to deliver high-quality, continent-wide reliability standards, both new and modified, including standard development outreach activities, facilitation of Standard Drafting Team activities, drafting support, assisting Standard Drafting Teams in adhering to the processes in the Standard Processes Manual, and ensuring that the quality of documents produced are appropriate for approval by industry and the NERC Board; (2) facilitating continent-wide industry engagement in the standard development processes; and (3) conducting industry balloting on standards, disseminating information on standards and the standard development processes, and supporting regulatory filings and proceedings relating to standards. Additionally, the Reliability Standards Program provides technical advice and final quality review for Regional Entity standards development processes, presents proposed regional standards to the NERC Board, and prepares submissions for approval of regional standards to the applicable regulatory authorities in the U.S. and Canada. For 2018, the major activities of the Reliability Standards Program will focus on (1) selection of standards projects to be undertaken based on the nature of the reliability issue, cost compared to risks, 1 North American Electric Reliability Corporation, Order Accepting 2013 Business Plan and Budget of the North American Electric Reliability Corporation and Ordering Compliance Filing, 141 FERC 61,086 (2012) ( 2013 Budget Order ). Recommendation 38, as adopted in the 2013 Budget Order, is: In its annual business plan and budget filings, [NERC should] provide an explanation as to why the proposed activities to be undertaken by each program area for the budget year are statutory, including, at a minimum: a description and the purpose of the major activities to be taken by each program area and an explanation for why the activity is a statutory activity. Id. at P Compliance Filing of the North American Electric Reliability Corporation in Response to Paragraph 30 of November 2, 2012 Commission Order NERC Written Criteria for Determining Whether a Reliability Activity is Eligible to be Funded Under Federal Power Act Section 215, filed February 1, 2013 in Docket No. FA ( February 1, 2013 Compliance Filing ). 3 North American Electric Reliability Corporation, Order on Compliance, 143 FERC 61,052 (2013) ( Compliance Order ). 4 For ease of reference, the complete NERC written criteria, as modified in accordance with the Compliance Order, are provided at the end of this Exhibit. 117

121 Exhibit B Application of NERC Section 215 Criteria and whether a standard or another solution is most appropriate to address the issue; (2) addressing Commission directives and responding to Commission orders as necessary through the standards process; (3) performing periodic reviews of standards; and (4) facilitating smooth transitions to new standards through developing guidelines, webinars, and other activities to support auditor and industry training for new standards. Identification of need for new standards projects will be based on sources such as Commission directives and reliability risks identified by the Reliability Risk Management Process or the Reliability Issues Steering Committee (RISC). The major activities of the Reliability Standards Program satisfy the following criteria: I.A: Is the activity necessary or appropriate for Reliability Standards development projects pursuant to the NERC Rules of Procedure (ROP)? I.B: Is the activity necessary or appropriate for providing guidance and assistance to Regional Entities in carrying out Regional Reliability Standards development activities? I.C: Is the activity necessary or appropriate for information gathering, collection and analysis activities to obtain information for Reliability Standards development, including for purposes of identifying areas in which new Reliability Standards could be developed, existing Reliability Standards could be revised, or existing Reliability Standards could be eliminated? I.D: Is the activity necessary or appropriate for the provision of training and education concerning Reliability Standards development processes, procedures, and topics for/to (i) NERC personnel, (ii) Regional Entity personnel, (iii) industry personnel? II.F.1: Is the activity necessary or appropriate for the provision of training, education and dissemination of information for/to (i) NERC personnel, (ii) Regional Entity personnel, and (ii) industry personnel with respect to compliance monitoring and enforcement topics and topics concerning reliability risks identified through compliance monitoring and enforcement activities, such as (1) Requirements of Reliability Standards, including how to comply and how to demonstrate compliance? This includes development of guidance and interpretation documents. IV: Is the activity one that was required or directed by a Commission order issued pursuant to 215? (Reliability Standards development projects are often initiated in response to directives in Commission orders). V: Is the activity one that is required or specified by, or carries out, the provisions of NERC s ROP that have been approved by the Commission as Electric Reliability Organization Rules (defined in 18 C.F.R. 39.1) pursuant to FPA 215(f)? (The applicable ROP provisions for these major activities are 300 and Appendix 3A.) VI: Is the activity necessary or appropriate for the supervision and oversight of Regional Entities in the performance of their delegated responsibilities in accordance with FPA 215, 18 C.F.R. Part 39, the Commission-approved delegation agreement between NERC and the Regional Entity, the NERC ROP, and applicable provisions of Commission orders? IX. Is the activity necessary or appropriate for NERC and Regional Entity committees, subcommittees and working groups engaged in activities encompassed by one or more of the other criteria? 118

122 Exhibit B Application of NERC Section 215 Criteria X. Is the activity necessary or appropriate for the analysis and evaluation of activities encompassed by one or more of the other criteria for the purpose of identifying means of performing the activities more effectively and efficiently? III. Compliance Monitoring and Enforcement and Organization Registration and Certification Program Area 2018 Major Activities The major activities of the Compliance Monitoring and Enforcement and Organization Registration and Certification Program Area are described at pages 28-32, 34-37, and of the 2018 Business Plan and Budget. This Program Area is comprised of three operational groups: (1) Compliance Assurance (addressing compliance monitoring), (2) Compliance Analysis, Organization Registration and Certification (addressing assurance, organization registration and certification), and (3) Compliance Enforcement. The Compliance Assurance group works collaboratively with the Regional Entities to ensure effective implementation of risk-based compliance monitoring under the Compliance Monitoring and Enforcement Program ( CMEP ) across the entire ERO Enterprise. This group s activities include the following major activities and functions: (1) ensuring that Regional Entities monitor registered entities for compliance according to their specific facts and circumstances, developing customized compliance oversight plans (COPs) for each registered entity based on its inherent risk assessment (IRA); (2) overseeing Regional Entities IRAs of registered entities; (3) oversight of the quality implementation of the risk-based compliance monitoring program; (4) development of the annual CMEP Implementation Plan; (5) oversight of use of necessary compliance-related processes, procedures, IT platforms, tools and templates; (6) development and delivery of education and training for ERO Enterprise staff; (7) conducting CIP V5 training and education programs and other outreach that support industry compliance and integration of risk assessment and internal controls; (8) conducting CIP training and outreach activities related to effective implementation of the Physical Security Reliability Standard; (9) coordinating with the NERC Standards department for standards development to provide compliance information, statistics, and perspectives to standard drafting teams to foster development of standards that provide increased reliability benefit and clarify compliance risks, and to assist in smooth transitions for standards from development to enforceability, including by providing draft compliance monitoring guidance, information on how compliance with draft standards will be determined, and input on auditability and enforceability; (10) supporting Regional Entity and industry committees, working groups and task forces, such as the NERC Compliance and Certification Committee; (11) industry training for every Reliability Standard approved by the Commission, as well as industry-focused outreach events and webinars on riskbased CMEP activities; and (12) promoting registered entities development of effective compliance programs and internal controls. The ongoing and new major activities of the Compliance Assurance group for 2018 will include: (1) continuing to implement the risk-based compliance program, including fully developing customized COPs for registered entities; (2) working with NERC Enforcement and IT and with Regional Entity staffs development of the CMEP Process tool; (3) supporting the continued successful implementation of CIP V5 standards and subsequent enhancements that became or become effective in 2017 and beyond; (4) continuing to monitor and support effective implementation and monitoring of the Physical Security Reliability Standard; (5) continuing the training program to support implementation of common audit procedures for each standard; (6) continuing to integrate standards and compliance functions for clear stakeholder implementation, including through a common set of Reliability Standards Audit Worksheets, measures, or successors for all standards and in initiating a compliance phase-in learning period for all standards; and (7) providing support and leadership to applicable committees and subcommittees including the CIPC and the CCC. 119

123 Exhibit B Application of NERC Section 215 Criteria The Compliance Analysis, Organization Registration and Certification group is responsible for a range of requirements and activities embodied in Section 500 and Appendices 5A and 5B of the NERC ROP, including providing technical resource support to standards development, compliance monitoring, and enforcement; ensuring that all entities impacting the BES are registered commensurate with risk; ensuring all Reliability Coordinators ( RC ), Balancing Authorities ( BA ) and Transmission Operators ( TOP ) are certified; conducting industry reliability assurance activities; and ensuring that compliance gaps identified in reportable events are assessed and addressed if appropriate. Major activities of this group include (1) registration of BES users, owners, and operators who are responsible for compliance with Commission-approved Reliability Standards; (2) evaluating and certification of the competency of RCs, BAs and TOPs; (3) conducting activities to reasonably assure the ERO that certain actions have been taken as reported in response to NERC Alerts or guidance to industry; (4) providing oversight of Regional Entity implementation of regional registration, compliance, certification, investigation, and complaint programs and processes; (5) conducting investigations to identify Possible Violations of Reliability Standards in response to complaints, BES disturbances, or other triggers, including participating on all Regional Entity-led investigations and as observers as requested on Commission-led reliability investigations and inquiries; (6) working with Regional Entity staff to confirm that qualified events and disturbances are evaluated against the relevant Reliability Standards and to ensure formal compliance monitoring occurs if indicated; and (7) addressing formal complaints that allege violations of Reliability Standards. Specific major activities of Compliance Analysis, Organization Registration and Certification for 2018 will include continuing to work with the NERC-led panel to review registered entities for deregistration or applicability to a reduced number of Reliability Standards; and implementing registration program improvements and certification program improvements identified in prior years, including conducting training as necessary. The Compliance Enforcement department is responsible for overseeing enforcement processes, the application of penalties or sanctions, and activities to mitigate and prevent recurrence of noncompliance with Reliability Standards. The Department works collaboratively with the Regional Entities to ensure consistent and effective implementation of the risk-based CMEP, including evaluating the consistency of disposition methods including assessment of penalties or sanctions. It also focuses on ensuring that the ERO Enterprise dedicates resources to the matters that pose the greatest risk to reliability. The Compliance Enforcement department monitors Regional Entities enforcement processes and provides oversight over the outcomes of such processes, to ensure due process, identify best practices and process efficiency opportunities, and promote consistency among Regional Entities business practices; collects and analyzes compliance enforcement data and trends to assist with identification of emerging risks and help to inform development of enforcement policy and processes; files notices of penalty ( NOP ) and other submittals associated with noncompliance discovered through Regional Entity compliance, monitoring and enforcement activities; processes and files NOPs and other submittals discovered through NERC-led investigations and audits; collaborates with other NERC departments, including Compliance Assurance, Reliability Standards and Regional Entity Coordination; and delivers training of the ERO Enterprise staff and outreach to registered entities on compliance and enforcement topics. Compliance Enforcement also conducts outreach activities that focus on self-logging, compliance exceptions, risk elements, CIP V5, IRAs, and internal controls. During 2018, the Compliance Enforcement department will continue to focus on the successful implementation of, as well as refining and improving, the risk-based CMEP. The major activities of Compliance Enforcement will include continuing to refine and improve risk-based CMEP processes; continuing to implement in a transparent manner the risk-focused ERO Enterprise enforcement philosophy; expanding the feedback loop of information from Enforcement to Standards and other program areas; and working with Compliance Assurance, IT, and Regional Entity staffs regarding 120

124 Exhibit B Application of NERC Section 215 Criteria improvements in the existing compliance, reporting, analysis system and other compliance tools to support risk-based activities. The major activities of the Compliance Monitoring and Enforcement and Organization Registration and Certification Program Area satisfy the following criteria: I.A: Is the activity necessary or appropriate for Reliability Standards development projects pursuant to the NERC ROP? I.C: Is the activity necessary or appropriate for information gathering, collection and analysis activities to obtain information for Reliability Standards development, including for purposes of identifying areas in which new Reliability Standards could be developed, existing Reliability Standards could be revised, or existing Reliability Standards could be eliminated? II.A: Is the activity necessary or appropriate for the identification and registration of users, owners, and operators of the Bulk Power System that are required to comply with Requirements of Reliability Standards applicable to the reliability functions for which they are registered? II.B: Is the activity necessary or appropriate for the Certification of Reliability Coordinators, Transmission Operators and Balancing Authorities as having the requisite personnel, qualifications and facilities and equipment needed to perform these reliability functions in accordance with the applicable Requirements of Reliability Standards? II.D: Is the activity necessary or appropriate for conducting, participating in or overseeing compliance monitoring and enforcement activities pursuant to the NERC ROP and (through the Regional Entities) the Commission-approved delegation agreements? II.E: Is the activity necessary or appropriate for information gathering, collection and analysis activities to obtain information to monitor and enforce compliance with Reliability Standards, including evaluating the effectiveness of current compliance monitoring and enforcement processes, the need for new or revised compliance monitoring and enforcement processes, and the need for new or different means of training and education on compliance with Reliability Standards. II.F: Is the activity necessary or appropriate for the provision of training, education and dissemination of information for/to (i) NERC personnel, (ii) Regional Entity personnel, and (iii) industry personnel with respect to compliance monitoring and enforcement topics and topics concerning reliability risks identified through compliance monitoring and enforcement activities, such as: (1) Requirements of Reliability Standards, including how to comply and how to demonstrate compliance? This includes development of guidance and interpretation documents. (2) Compliance monitoring and enforcement processes, including how to conduct them, how to participate in them, and the expectations for the process? This includes development of guidance documents. (3) Disseminating, through workshops, webinars, Advisories/Recommendations/Essential Actions, and other publications, lessons learned information on compliance concerns and reliability risks obtained through compliance monitoring and enforcement activities, monitoring and investigation of Bulk Power System major events, offnormal occurrences and near miss events, and other Bulk Power System monitoring activities? (4) Registered Entity internal processes for compliance with Reliability Standards, such as development, implementation and maintenance of internal reliability compliance programs? 121

125 Exhibit B Application of NERC Section 215 Criteria V: Is the activity one that is required or specified by, or carries out, the provisions of NERC s ROP that have been approved by the Commission as Electric Reliability Organization Rules (defined in 18 C.F.R. 39.1) pursuant to FPA 215(f)? (The applicable ROP provisions for these major activities are 400 and 500 and Appendices 4B, 4C, 5A, 5B and 5C.) VI: Is the activity necessary or appropriate for the supervision and oversight of Regional Entities in the performance of their delegated responsibilities in accordance with FPA 215, 18 C.F.R. Part 39, the Commission-approved delegation agreement between NERC and the Regional Entity, the NERC ROP, and applicable provisions of Commission orders? IX: Is the activity necessary or appropriate for NERC and Regional Entity committees, subcommittees and working groups engaged in the activities encompassed by one or more of the other criteria? X: Is the activity necessary or appropriate for the analysis and evaluation of activities encompassed by one or more of the other criteria for the purpose of identifying means of performing the activities more effectively and efficiently? IV. Reliability Assessment and System Analysis Program 2018 Major Activities The major activities of the Reliability Assessment and System Analysis (RASA) Program are described at pages of the 2018 Business Plan and Budget. The RASA Program carries out the ERO s responsibility to conduct assessments of the reliability and adequacy of the BES to provide insight and guidance about reliability risks. RASA focuses on developing a technical framework and understanding of the emerging reliability risks facing the industry. The principal activity areas of the RASA Program include: independent assessments and reports on the overall reliability and adequacy of the BES, and associated reliability risks that could impact the upcoming summer and winter seasons and the long-term (e.g. 10- year) planning horizon and other reliability issues requiring an in-depth analysis; interconnection-wide analysis for analyzing steady-state and dynamic conditions, including frequency, Essential Reliability Services, stability, and oscillatory behavior aspects; assurance oversight that electrical elements necessary for reliable operation of the BES are appropriately identified as BES elements; support for development and improvement of long-term sustainable interconnection-based power flow, dynamic and load models that exhibit the accuracy and fidelity reflecting actual BES reliability performance and dynamic conditions; advancement of industry and the ERO s understanding of power system characteristics and behaviors by gathering larger PMU datasets of data for advanced data analytics and modeling improvements; and establishing reliability leadership and consistent, technically sound guidance and recommendations that position industry and policy-makers to enhance reliability through effective outreach and communications. The RASA Program works with industry leaders to create a reliability strategy that is relevant, timely, and effective at addressing the most important reliability risks, through reviewing and addressing key priority risks identified by the NERC RISC, synthesizing information identified through analysis and assessment efforts, extracting and prioritizing the associated reliability risks; sharing and integrating risk analysis insights across the ERO Enterprise; and translating that knowledge into actionable guidance and recommendations for NERC management, the Board, and entities, and government policy makers. Reliability assessments evaluate the expected reliability behavior of the BPS through extensive deterministic and probabilistic analyses to identify potential reliability risks and potential mitigation approaches. RASA monitors the ongoing and historic reliability performance of the BES through data gathered to analyze historic trends and provides reports and recommendations regarding the associated conditions that could impact reliability, security and stability of the BPS. RASA assesses and reports on the 122

126 Exhibit B Application of NERC Section 215 Criteria reliability, adequacy and associated risks that could impact short-term and long-term study periods, and conducts special reliability assessments and identifies recommendations and guidance actions that may be warranted to lessen identified risks or enhance overall reliability. RASA also coordinates forecast reliability data between planning areas, the Regional Entities, and government organizations. A significant ongoing effort involving RASA, Regional Entity staff, and stakeholders focuses on continued development of effective Essential Reliability Services, leading to defined Essential Reliability Services, an evaluation of initial metrics and data compilation of actual performance, and ongoing assessment. RASA works closely with other organizations such as the Electric Power Research Institute (EPRI), Department of Energy (DOE), Institute of Electrical and Electronics Engineers (IEEE), Institute of Nuclear Power Operations (INPO), North American Transmission Forum (NATF), North American Generation Forum (NAGF), Canadian Electricity Association (CEA), Interstate Natural Gas Association of America, and Natural Gas Supply Association, on a number of energy industry reliability issues such as geomagnetic disturbances, vegetation management, variable generation integration, and interdependency of gas and electric systems. The ongoing and new major activities of the RASA Program for 2018 include: (1) implementing advanced reliability assessment and system analysis methods to address the changing nature of the grid, including issuing reliability assessment reports, guidelines, and recommendations to address high priority evolving performance trends and address emerging risks to reliability; (2) issuing special assessments on identified high-priority risks as prioritized and recommended by the RISC, including on changing resource mix and maintaining Essential Reliability Services, increased penetration of distributed energy resources, increasing dependency on generation fuel by natural gas, and inter-area and local system oscillations in all interconnections and their potential impact on interconnection reliability; (3) developing technical analyses in key reliability areas, such as Frequency Response, Short Circuit Strength, Inter-Areas Oscillation, and Distributed Energy resources, and providing technical expertise, research and feedback to the industry; (4) supporting Reliability Standard development by providing subject matter expertise; (5) Providing support and leadership to the NERC Planning Committee and to standing committees and subcommittees, working groups, and task forces; (6) supporting major event investigations, analyses, and reporting of major findings, recommendations, and lessons learned that will improve reliability; (7) providing feedback to interconnection-wide model-building groups on improvements to system model quality and fidelity; and (8) assist in development of approaches to registration and provide input to NERC staff in support of the development of CMEP risk elements, as well as supporting and leading the BES Definition Exception process and processing Self-Determined Notifications. The major activities of the RASA Program satisfy the following criteria: I.A: is the activity necessary or appropriate for Reliability Standards development projects pursuant to the NERC ROP? I.C.1: Is the activity necessary or appropriate for information gathering, collection and analysis activities to obtain information for Reliability Standards development, including for purposes of identifying areas in which new Reliability Standards could be developed, existing Reliability Standards could be revised, or existing Reliability Standards could be eliminated, such as: (1) Measuring reliability performance past, present and future; publishing or disseminating the results of such measurements; analyzing the results of such measurements; identifying and analyzing risks to reliability of the Bulk Power System based on such measurements; and/or identifying approaches to mitigating or eliminating such risks? 123

127 Exhibit B Application of NERC Section 215 Criteria II.A: Is the activity necessary or appropriate for the identification and registration of users, owners, and operators of the Bulk Power System that are required to comply with Requirements of Reliability Standards applicable to the reliability functions for which they are registered? III.A: Is the activity necessary or appropriate for the preparation or dissemination of long-term, seasonal, and special assessments of the reliability and adequacy of the Bulk Power System? III.B: Is the activity necessary or appropriate for measuring reliability performance past, present and future; publishing or disseminating the results of such measurements; analyzing the results of such measurements; identifying and analyzing risks to reliability of the Bulk Power System based on such measurements; and/or identifying approaches to mitigating or eliminating such risks? III.F: Is the activity necessary or appropriate for the development and dissemination of Advisories/Recommendations/Essential Actions regarding lessons learned and potential reliability risks to users, owners, and operators of the Bulk Power System? IV: Is the activity one that was required or directed by a Commission order issued pursuant to 215? (FERC orders directed NERC to develop and implement a revised definition of Bulk Electric System and a procedure for requesting and receiving exceptions from the BES definition, and subsequently approved NERC s proposed revised BES definition and its proposed BES exception procedure.) V. Is the activity one that is required or specified by, or carries out, the provisions of NERC s ROP that have been approved by the Commission as Electric Reliability Organization Rules (defined in 18 C.F.R. 39.1) pursuant to FPA 215(f)? (The applicable ROP provisions for this major activity are and and Appendix 5C.) VI: Is the activity necessary or appropriate for the supervision and oversight of Regional Entities in the performance of their delegated responsibilities in accordance with FPA 215, 18 C.F.R. Part 39, the Commission-approved delegation agreement between NERC and the Regional Entity, the NERC ROP, and applicable provisions of Commission orders? IX: Is the activity necessary or appropriate for NERC and Regional Entity committees, subcommittees and working groups engaged in activities encompassed by one or more of the other criteria? X: Is the activity necessary or appropriate for the analysis and evaluation of activities encompassed by one or more of the other criteria for the purpose of identifying means of performing the activities more effectively and efficiently? V. Reliability Risk Management (Situation Awareness and Event Analysis) 2018 Major Activities The major activities of the Reliability Risk Management ( RRM ) group, which is comprised of the Situation Awareness Department, the Event Analysis Department, and the Performance Analysis group, are described at pages 51-53, 55-56, and of the 2018 Business Plan and Budget. The RRM group carries out the ERO s responsibility to perform assessments (including real-time and near-real-time continual awareness, detailed analysis of significant events, and longer-term broad performance assessments) of the reliability and adequacy of the BES, including identifying potential issues of concern relating to system, equipment, entity, and human performance. RRM has six primary functions: (1) BES 124

128 Exhibit B Application of NERC Section 215 Criteria awareness, (2) event analysis and determination of root and contributing causes, (3) assessment of human performance challenges that affect BES reliability and identification of improvement opportunities, (4) continent-wide analysis and reporting of BES performance, (5) support of the NERC Operating Committee, and (6) support of the NERC Critical Infrastructure Protection Committee. Through awareness and continuous assessment, RRM identifies potential reliability risks to the BES, analyzes events in detail, ensures that industry is well informed of system events, emerging trends, risk analysis, and lessons learned, and provides data and analysis to inform other aspects of NERC s statutory functions. The Situation Awareness department along, with the Regional Entities, monitors BES conditions, significant occurrences and emerging risks, and threats across the 14 Reliability Coordinator regions in North America. Situation Awareness also supports development and publication of NERC Alerts and awareness products, and facilitates information sharing among industry, Regions and government during crisis situations and major system disturbances. Situation Awareness is engaged in enhancement, replacement, streamlining or modification of several reliability-related situation awareness and monitoring tools, including SAFNRv2, operation and maintenance pending replacement of the current secure alert tool, refreshing the Reliability Coordinator Information System application, and continuing to set conditions to bring limited Synchrophasor data into NERC for wide-area situational awareness and event triage applications. The Situation Awareness Department uses the following reliability-related tools to support its activities: Resource Adequacy (ACE Frequency) Tool; Inadvertent Interchange; Frequency Monitoring and Analysis Tool; Intelligent Alarms Tool; and Genscape (PowerIQ and PowerRT tools). The ongoing and new major activities of the Situation Awareness department for 2018 include: ensuring that the ERO is aware of all BES events above a threshold of impact; enabling the sharing of information and data to facilitate wide area situational awareness; during crisis situations, facilitating the exchange of information among industry, Regions, and U.S. and Canadian governments; keeping the industry informed of emerging reliability threats and risks to the BES, including any expected actions; conducting the annual NERC Monitoring and Situational Awareness Conference and Human Performance Conference; administering the NERC Alerts process as specified in 810 of the ROP to issue Advisory (Level 1) Alerts on significant and emerging reliability and security related topics, and facilitate the tracking of actions specified in Recommendation (Level 2) and Essential Action (Level 3) Alerts; and performing oversight as per the Situation Awareness Oversight Plan of the activities and performance of the Regional staffs. The Event Analysis department performs assessments of the reliability and adequacy of the BES to identify potential issues of concern related to system, equipment, entity, and human performance that may indicate a need to develop remediation strategies, action plans, or data used to revise Reliability Standards or consider new Reliability Standards. Event Analysis conducts analyses to determine the causes of events, promptly assures tracking of corrective actions to prevent recurrence, and provides lessons learned to the industry. Event Analysis analyzes all reportable events for sequence of events, root cause, risks to reliability, and mitigation and ensures that the industry is well-informed of system events, emerging trends, risk analysis, lessons learned, and expected actions. Event Analysis conducts in-depth analyses of approximately 150 events per year on average. Additionally, Event Analysis identifies human error risks and precursor factors that allow human error to affect BES reliability, and educates industry regarding such risks, precursors, and related mitigation methods. Event analysis also supports compliance and standards training initiatives and trending and analysis to identify emerging reliability risks to the BES. Event Analysis works in collaboration with and supports the activities of other groups involved in human performance analysis including the NERC Operating Committee s Event Analysis Subcommittee, the WECC Human Performance Working Group, and others. Event Analysis also collaborates with industry groups including the NATF, NAGF, and trade associations. 125

129 Exhibit B Application of NERC Section 215 Criteria The ongoing and new major activities for 2018 for the Event Analysis department include: (1) Working with Regional Entities to obtain and review information from registered entities on qualifying events and disturbances in order to advance awareness of events above a threshold level; facilitating analysis of root and contributing causes, risks to reliability, wide area assessments and remediation efforts; and disseminating information regarding events in a timely manner. (2) Ensuring that all reportable events are analyzed for sequence of events, root cause, risk to reliability, and mitigation. (3) Continuing to refine risk-based methodologies to support better identification of reliability risks, including use of more sophisticated cause codes for analysis. (4) Conducting training (webinars, workshops and conference support) to inform industry and the ERO of lessons learned, root cause analysis, trends, human performance, and extreme weather preparedness and recommendations. (5) Developing reliability recommendations and alerts as needed, and tracking industry accountability for critical reliability recommendations. (6) Ensuring that industry is well informed of system events, emerging trends, risk analysis, lessons learned, and expected actions. (7) Conducting major event analysis and reporting of major findings and recommendations that will improve reliability. The Event Analysis department will also support several top priority reliability risk projects being led by the Performance Analysis program. The Performance Analysis group provides insight and guidance about reliability risks and areas of concern based on analysis of historic system performance, including with respect to system, equipment, entity and organizational performance that may indicate a need to develop remediation strategies, action plans, or data used to revise or retire Reliability Standards or consider new Reliability Standards. Performance Analysis focuses on developing a technical framework and understanding reliability risks facing the industry. Performance Analysis collects transmission outage, generator performance, demand response, and protection and control systems misoperation data in a common format using various industry databases; this data is used to develop and report grid metrics that analyze outage frequency, duration, causes, and other factors related to transmission and generator performance and automatic power system protection and control effectiveness. Trends, findings and recommendations from PA serve as technical input to Reliability Standards and to standards project prioritization, compliance process improvements, event analyses, reliability assessment, and critical infrastructure protection efforts. In 2017, PA added wind generator data to the data collected, and in 2018 will add solar data. The analyses and results collected and produced are reported in the annual State of Reliability Report, which provides guidance and recommendations for enhanced bulk system reliability. In 2017, the State of Reliability Report is beginning to reflect post-seasonal reliability review, insights from analysis of transmission, generator, and demand response data systems, and integration of event analysis and misoperations. Performance Analysis works closely with other organizations including EPI, DOE, IEEE, INPO, NATF, NAGF, and CEA, on a number of fronts, including the Transmission Availability Data System (TADS), Generator Data Availability System (GADS), and Demand Response Availability Data System (DADS). Performance Analysis s ongoing and new major activities for 2018 will include the following: (1) Issuing the State of Reliability Report and guidelines, recommendations, and alerts as needed, including verification and validation of data and information through Regional Entities and technical committees. (2) Overseeing and evaluating reliability trends that identify reliability risks, by analyzing data contained in TADS, GADS and TADS as well as reliability metrics and protection and control systems misoperations data. (3) Supporting Reliability Standards development by providing subject matter expertise. (4) Providing support and leadership to the NERC standing committees subcommittees, working groups, and task forces serving the standing committees. (5) Assisting in the development of approaches to registration and providing input to NERC staff in support of development of CMEP risk elements. (6) Conducting major event investigations, analyses, and reporting of major findings, recommendations, and 126

130 Exhibit B Application of NERC Section 215 Criteria lessons learned that will improve reliability. (7) Providing insight on emerging system protection issues, and handing off any issues with future implications to RASA. The major activities of the RRM group satisfy the following criteria: I.A: is the activity necessary or appropriate for Reliability Standards development projects pursuant to the NERC ROP? I.C.1: Is the activity necessary or appropriate for information gathering, collection and analysis activities to obtain information for Reliability Standards development, including for purposes of identifying areas in which new Reliability Standards could be developed, existing Reliability Standards could be revised, or existing Reliability Standards could be eliminated, such as: (1) Measuring reliability performance past, present and future; publishing or disseminating the results of such measurements; analyzing the results of such measurements; identifying and analyzing risks to reliability of the Bulk Power System based on such measurements; and/or identifying approaches to mitigating or eliminating such risks? (2) Monitoring, event analysis and investigation of Bulk Power System major events, off-normal occurrences and near miss events? I.C.2: Is the activity necessary or appropriate for information gathering, collection and analysis activities to obtain information for Reliability Standards development, including for purposes of identifying areas in which new Reliability Standards could be developed, existing Reliability Standards could be revised, or existing Reliability Standards could be eliminated, such as: (2) Monitoring, event analysis and investigations of Bulk Power System major events, off-normal occurrences and near-miss events? II.A: Is the activity necessary or appropriate for the identification and registration of users, owners, and operators of the Bulk Power System that are required to comply with Requirements of Reliability Standards applicable to the reliability functions for which they are registered? II.E.2: Is the activity necessary or appropriate for information gathering, collection and analysis activities to obtain information to monitor and enforce compliance with Reliability Standards, including evaluating the effectiveness of current compliance monitoring and enforcement processes, the need for new or revised compliance monitoring and enforcement processes, and the need for new or different means of training and education on compliance with Reliability Standards, such as: (2) Monitoring, event analysis and investigation of Bulk Power System major events, off-normal occurrences, and near miss events? II.F.3: Is the activity necessary or appropriate for the provision of training, education and dissemination of information for/to (i) NERC personnel, (ii) Regional Entity personnel, and (iii) industry personnel with respect to compliance monitoring and enforcement topics and topics concerning reliability risks identified through compliance monitoring and enforcement activities, such as: (3) Disseminating, through workshops, webinars, Advisories, Recommendations, Essential Actions, and other publications; lessons learned information on compliance concerns and reliability risks obtained through compliance monitoring and enforcement activities; monitoring and investigation of Bulk Power System major events, off-normal occurrences and near miss events, and other Bulk Power System monitoring activities? II.G: Is the activity necessary or appropriate for the development and provision of tools and services that are useful for the provision of adequate reliability, because they relate specifically 127

131 Exhibit B Application of NERC Section 215 Criteria to compliance with existing Reliability Standards and they proactively help avert Reliability Standard violations and Bulk Power System disturbances? III.A: Is the activity necessary or appropriate for the preparation or dissemination of long-term, seasonal, and special assessments of the reliability and adequacy of the Bulk Power System? III.B: Is the activity necessary or appropriate for measuring reliability performance past, present and future; publishing or disseminating the results of such measurements; analyzing the results of such measurements; identifying and analyzing risks to reliability of the Bulk Power System based on such measurements; and/or identifying approaches to mitigating or eliminating such risks? III.C: Is the activity necessary or appropriate for investigating, analyzing, evaluating, and disseminating information concerning, the causes of major events and off-normal occurrences, and/or providing coordination assistance, technical expertise and other assistance to users, owners, and operators of the Bulk Power System in connection with Bulk Power System major events and off-normal occurrences, but not real-time operational control of the Bulk Power System? III.D: Is the activity necessary or appropriate for awareness of circumstances on the Bulk Power System and to contribute to understanding risks to reliability? III.F: Is the activity necessary or appropriate for the development and dissemination of Advisories/Recommendations/Essential Actions regarding lessons learned and potential reliability risks to users, owners, and operators of the Bulk Power System? V: Is the activity one that is required or specified by, or carries out, the provisions of NERC s ROP that have been approved by the Commission as Electric Reliability Organization Rules (defined in 18 C.F.R. 39.1) pursuant to FPA 215(f)? (The applicable ROP provisions for these major activities are and 1001 and Appendix 8.) IX. Is the activity necessary or appropriate for NERC and Regional Entity committees, subcommittees and working groups engaged in activities encompassed by one or more of the other criteria? VI. Electricity Information Sharing and Analysis Center 2018 Major Activities The major activities of the Electricity Information Sharing and Analysis Center ( E-ISAC ) are described at pages of the 2018 Business Plan and Budget. The primary function of E-ISAC is to reduce cyber and physical risk to the Electricity Subsector across North America by providing unique insights, leadership and coordination, and to be the trusted, timely, actionable resource of grid risk information and analysis to enhance electric reliability. The E-ISAC facilitates electricity sector coordination regarding physical security and cybersecurity events affecting the BES. E-ISAC analytic personnel maintain a detailed understanding of emerging vulnerabilities and threats within the broad industrial control systems community and the more focused BES community, utilizing, among other sources, intelligence reporting services. E-ISAC manages and executes NERC s responsibilities in the Cybersecurity Risk Information Sharing Program ( CRISP ) and acts as the program manager for CRISP. The purpose of CRISP is to facilitate the sharing of cyber threat information and to develop situation awareness tools that enhance the electricity sector s ability to identify, prioritize, and coordinate protection of its critical infrastructure. ES- ISAC also supports an annual grid security conference and a biennial Grid Security Exercise. During 2018, 128

132 Exhibit B Application of NERC Section 215 Criteria the E-ISAC s and CRISP s activities will include development and implementation of significant improvements to or replacement of the E-ISAC portal to extend its functionality and allow for easier access to filter data for the cyber and physical security communities and for automated information sharing. The major activities of the ES-ISAC satisfy the following criteria: I.C.1: Is the activity necessary or appropriate for information gathering, collection and analysis activities to obtain information for Reliability Standards development, including for purposes of identifying areas in which new Reliability Standards could be developed, existing Reliability Standards could be revised, or existing Reliability Standards could be eliminated, such as: (1) Measuring reliability performance past, present and future; publishing or disseminating the results of such measurements; analyzing the results of such measurements; identifying and analyzing risks to reliability of the Bulk Power System based on such measurements; and/or identifying approaches to mitigating or eliminating such risks? (2) Monitoring, event analysis and investigation of Bulk Power System major events, off-normal occurrences and near-miss events? III.D: Is the activity necessary or appropriate for awareness of circumstances on the Bulk Power System and to contribute to understanding risks to reliability. III.E: Is the activity necessary or appropriate for gathering, analyzing and sharing with and among industry and government participants, information regarding the physical or cyber security of the Bulk Power System. III.F: Is the activity necessary or appropriate for the development and dissemination of Advisories/Recommendations/Essential Actions regarding lessons learned and potential reliability risks to users, owners, and operators of the Bulk Power System? V: Is the activity one that is required or specified by, or carries out, the provisions of NERC s ROP that have been approved by the Commission as Electric Reliability Organization Rules (defined in 18 C.F.R. 39.1) pursuant to FPA 215(f)? (The applicable ROP provisions for these major activities are 810 and 1003.) IX. Is the activity necessary or appropriate for NERC and Regional Entity committees, subcommittees and working groups engaged in activities encompassed by one or more of the other criteria? VII. Training, Education, and Personnel Certification Program 2018 Major Activities The major activities of the Training, Education, and Personnel Certification Program are described at pages of the 2018 Business Plan and Budget. The major activities of this program include oversight and coordination of the delivery of training programs to NERC and Regional Entity staff; as well as training and education for industry participants on the requirements of Reliability Standards, the Reliability Standards development process, and the compliance monitoring and enforcement process. The Training and Education Program supports the ERO s responsibilities to develop, adopt, and obtain approval of Reliability Standards and to monitor, enforce and achieve compliance with the mandatory standards. The Training and Education Program also supports NERC s System Personnel Certification Program, which ensure that personnel operating the BES have the skills, training and qualifications needed to operate the BES reliably. This Program maintains the credentials required to work in system control centers across North America for over 7,500 system operators. The Training and Education Program prepares operators for complying with requirements of Reliability Standards and appropriately operating 129

133 Exhibit B Application of NERC Section 215 Criteria the BES during normal and emergency operations. Education and training activities include the following subject matter: risk-based compliance monitoring and enforcement; standards and compliance; organization registration and certification; event analysis, cause analysis, performance analysis, and lessons learned; reliability assessment and system analysis; continuing education for system operators; and new system operator certification examinations for the Reliability Coordinator, Transmission Operator, Balancing and Interchange Operator, and Balancing, Interchange and Transmission Operator credentials. The major activities of the Training, Education, and Personnel Certification Program for 2018 include implementing the annual NERC and ERO Enterprise Learning Priorities Plan which articulates and prioritizes the accumulated learning needs of the ERO Enterprise and the potential delivery vehicles supporting achievement of the corporate metrics for the strategic goals. The focus for 2018 (and beyond) includes reliability risk management technique (targeting industry), risk-based compliance performance (targeting the ERO Enterprise), and functional and technical enhancements to enhance employee understanding of NERC functions and core technical knowledge for regulating the BPS (targeting NERC employees). Training and education will be delivered through workshops, webinars, and computer-based and instructor-led training courses. The Continuing Education program will evaluate and revise current program criteria as reflected in the program manual. The Personnel Certification Program will focus on the annual analysis of the exam Item Bank; new certification exam items; a new credential maintenance tool; and the strategic plan for program enhancements. The major activities of the Training, Education, and Personnel Certification Program satisfy the following criteria: I.D: Is the activity necessary or appropriate for the provision of training and education concerning Reliability Standards development processes, procedures and topics for/to (i) NERC personnel, (ii) Regional Entity personnel, and (iii) industry personnel? II.C: Is the activity necessary or appropriate for the Certification of system operating personnel as qualified to carry out the duties and responsibilities of their positions in accordance with the Requirements of applicable Reliability Standards? II.F: Is the activity necessary or appropriate for the provision of training, education and dissemination of information for/to (i) NERC personnel, (ii) Regional Entity personnel, and (iii) industry personnel with respect to compliance monitoring and enforcement topics and topics concerning reliability risks identified through compliance monitoring and enforcement activities, such as: (1) Requirements of Reliability Standards, including how to comply and how to demonstrate compliance? This includes development of guidance and interpretation documents. (2) Compliance monitoring and enforcement processes, including how to conduct them, how to participate in them, and the expectations for the processes? This includes development of guidance documents. (3) Disseminating, through workshops, webinars, Advisories/Recommendations/Essential Actions, and other publications, lessons learned information on compliance concerns and reliability risks obtained through compliance monitoring and enforcement activities, monitoring and investigation of Bulk Power System major events, offnormal occurrences and near miss events, and other Bulk Power System monitoring activities. (4) Registered Entity internal processes for compliance with Reliability Standards, such as development, implementation and maintenance of internal reliability compliance programs? V: Is the activity one that is required or specified by, or carries out, the provisions of NERC s ROP that have been approved by the Commission as Electric Reliability Organization Rules 130

134 Exhibit B Application of NERC Section 215 Criteria (defined in 18 C.F.R. 39.1) pursuant to FPA 215(f)? (The applicable ROP provision for these major activities are 600 and 900.) VI: Is the activity necessary or appropriate for the supervision and oversight of Regional Entities in the performance of their delegated responsibilities in accordance with FPA 215, 18 C.F.R. Part 39, the Commission-approved delegation agreement between NERC and the Regional Entity, the NERC ROP, and applicable provisions of Commission orders? VIII. Administrative Services 2018 Major Activities NERC s Administrative Services Departments are Technical Committees and Member Forums (for which no funding for activities is budgeted for 2018), General and Administrative, Legal and Regulatory, Information Technology ( IT ), Human Resources, and Finance and Accounting. The major activities of these departments are described at pages of the 2018 Business Plan and Budget. General and Administrative includes the administration and general management of the organization, the Chief Executive Officer and Chief Reliability Officer, Board of Trustees costs, communications, external affairs and government relations, and office rent. Legal and Regulatory provides legal support to the organization, including to management, and the Reliability Standards, Compliance Analysis, Organization Registration and Certification, Reliability Risk Management, and RASA Programs, as well as general corporate legal support in areas including antitrust, corporate, commercial, insurance, contracts, employment, real estate, copyright, tax, and other areas. IT supports NERC s computing, Internet, database and electronic data storage and maintenance, and telecommunications and internet needs, programs, applications and infrastructure, including management of the development and implementation of new software applications and infrastructure. The capital expenditure projects managed by IT represent capital expenditures in hardware, software and associated tools to securely gather, store, analyze and maintain data across the ERO Enterprise to support the ERO s operations, as well as necessary acquisition and replacement of computers, servers and related devices. IT s 2018 activities are focused on NERC infrastructure and support; improving, enhancing, or replacing existing functionalities; ERO Enterprise infrastructure and support; and ERO Enterprise new functionalities, including the document management program. Human Resources manages all of NERC s human resources functions, including staffing, benefits administration, employee relations, performance and compensation management, succession planning, and training and development. Human Resources also obtains compensation studies, effectiveness studies, and other compensation consulting services when needed. Finance and Accounting manages all finance and accounting functions of NERC, including employee payroll, 401(k), 457(b) and 457(f) plans, travel and expense reporting, monthly financial reporting, sales and use tax, meetings and events planning and services, insurance, internal audit, facilities management, development of the annual business plan and budget, and the ERO risk management framework. The major activities of NERC s Administrative Services Departments satisfy the following criteria: I.A: Is the activity necessary or appropriate for Reliability Standards development projects pursuant to the NERC ROP? 131

135 Exhibit B Application of NERC Section 215 Criteria II.A: Is the activity necessary or appropriate for the identification and registration of users, owners, and operators of the Bulk Power System that are required to comply with Requirements of Reliability Standards applicable to the reliability functions for which they are registered? II.D: Is the activity necessary or appropriate for conducting, participating in or overseeing compliance monitoring and enforcement activities pursuant to the NERC ROP and (through the Regional Entities) the Commission-approved delegation agreements? III.C: Is the activity necessary or appropriate for investigating, analyzing, evaluating, and disseminating information concerning, the causes of major events and off-normal occurrences, and/or providing coordination assistance, technical expertise and other assistance to users, owners, and operators of the Bulk Power System in connection with Bulk Power System major events and off-normal occurrences, but not real-time operational control of the Bulk Power System? V: Is the activity one that is required or specified by, or carries out, the provisions of NERC s ROP that have been approved by the Commission as Electric Reliability Organization Rules (defined in 18 C.F.R. 39.1) pursuant to FPA 215(f)? (The applicable ROP provision for the major activities of Finance and Accounting is 1100.) VI: Is the activity necessary or appropriate for the supervision and oversight of Regional Entities in the performance of their delegated responsibilities in accordance with FPA 215, 18 C.F.R. Part 39, the Commission-approved delegation agreement between NERC and the Regional Entity, the NERC ROP, and the applicable provisions of Commission orders. IX. Is the activity necessary or appropriate for NERC and Regional Entity committees, subcommittees and working groups engaged in activities encompassed by one or more of the other criteria? XI: Is the activity a governance or administrative/overhead function, activity or service necessary or appropriate for the activities encompassed by the other criteria and, in general, necessary and appropriate to operate a functioning organization? 132

136 NERC WRITTEN CRITERIA FOR DETERMINING WHETHER AN ACTIVITY IS ELIGIBLE TO BE FUNDED UNDER SECTION 215 OF THE FEDERAL POWER ACT For purposes of internal management approval of a proposed new activity or group of related activities ( major activity ), the proposed activity or major activity must be shown to fall within at least one of the criteria listed below. When sub-criteria are listed below a roman numeral numbered major criterion, the proposed activity should be a positive answer to at least one of the sub-criteria. Conversely, an activity that falls under a sub-criterion should pertain to the subject matter of the major criterion. NERC s annual business plan and budget will describe how each major activity falls within one or more of the criteria listed below. If the major activity is substantially the same as a major activity that was shown to fall within the criteria in a previous year s business plan and budget, the current year s business plan and budget can refer to the prior year business plan and budget. A determination that an activity falls within FPA 215 does not necessarily mean that NERC will propose or undertake such activity. The determination of whether an activity falling under FPA 215 should or will be undertaken in a given budget year will be addressed in the context of the applicable business plan and budget and will include opportunities for stakeholder input. The criteria listed below are not necessarily each distinct from the others. An activity or major activity may fall within more than one of the criteria listed below. I. Is the activity necessary or appropriate for the development of Reliability Standards? II. A. Is the activity necessary or appropriate for Reliability Standards development projects pursuant to the NERC ROP? B. Is the activity necessary or appropriate for providing guidance and assistance to Regional Entities in carrying out Regional Reliability Standards development activities? C. Is the activity necessary or appropriate for information gathering, collection and analysis activities to obtain information for Reliability Standards development, including for purposes of identifying areas in which new Reliability Standards could be developed, existing Reliability Standards could be revised, or existing Reliability Standards could be eliminated, such as: 1. Measuring reliability performance past, present and future; publishing or disseminating the results of such measurements; analyzing the results of such measurements; identifying and analyzing risks to reliability of the Bulk Power System 48 based on such measurements; and/or identifying approaches to mitigating or eliminating such risks? 2. Monitoring, event analysis and investigation of Bulk Power System major events, off-normal occurrences and near miss events? D. Is the activity necessary or appropriate for the provision of training and education concerning Reliability Standards development processes, procedures and topics for/to (i) NERC personnel, (ii) Regional Entity personnel, and (iii) industry personnel? Is the activity necessary or appropriate for the monitoring and enforcement of compliance with Reliability Standards? A. Is the activity necessary or appropriate for the identification and registration of users, owners, and operators of the Bulk Power System that are required to comply with 48 This document uses the term Bulk Power System because that is the term defined and used in FPA 215. NERC recognizes that a different term, Bulk Electric System, is used to define the current reach of reliability standards. 133

137 Exhibit B Application of NERC Section 215 Criteria Requirements of Reliability Standards applicable to the reliability functions for which they are registered? B. Is the activity necessary or appropriate for the Certification of Reliability Coordinators, Transmission Operators and Balancing Authorities as having the requisite personnel, qualifications and facilities and equipment needed to perform these reliability functions in accordance with the applicable Requirements of Reliability Standards? C. Is the activity necessary or appropriate for the Certification of system operating personnel as qualified to carry out the duties and responsibilities of their positions in accordance with the Requirements of applicable Reliability Standards? 49 D. Is the activity necessary or appropriate for conducting, participating in or overseeing compliance monitoring and enforcement activities pursuant to the NERC ROP and (through the Regional Entities) the Commission-approved delegation agreements? E. Is the activity necessary or appropriate for information gathering, collection and analysis activities to obtain information to monitor and enforce compliance with Reliability Standards, including evaluating the effectiveness of current compliance monitoring and enforcement processes, the need for new or revised compliance monitoring and enforcement processes, and the need for new or different means of training and education on compliance with Reliability Standards, such as: 1. Measuring reliability performance past, present and future; publishing or disseminating the results of such measurements; analyzing the results of such measurements; identifying and analyzing risks to reliability of the Bulk Power System based on such measurements; and/or identifying approaches to mitigating or eliminating such risks? 2. Monitoring, event analysis and investigation of Bulk Power System major events, off-normal occurrences, and near miss events? F. Is the activity necessary or appropriate for the provision of training, education and dissemination of information for/to (i) NERC personnel, (ii) Regional Entity personnel, and (iii) industry personnel with respect to compliance monitoring and enforcement topics and topics concerning reliability risks identified through compliance monitoring and enforcement activities, such as: 1. Requirements of Reliability Standards, including how to comply and how to demonstrate compliance? This includes development of guidance and interpretation documents. 2. Compliance monitoring and enforcement processes, including how to conduct them, how to participate in them, and the expectations for the processes? This includes development of guidance documents. 3. Disseminating, through workshops, webinars, Advisories, Recommendations, Essential Actions, and other publications; lessons learned information on compliance concerns and reliability risks obtained through compliance monitoring and enforcement activities; monitoring and investigation of Bulk Power System major events, off-normal occurrences and near miss events, and other Bulk Power System monitoring activities? 49 Although certification of system operating personnel is an activity falling within the scope of, and eligible to be funded pursuant to, FPA 215, NERC strives to fully fund the costs of this activity through fees charged to participants. 134

138 III. IV. Exhibit B Application of NERC Section 215 Criteria 4. Registered Entity internal processes for compliance with Reliability Standards, such as development, implementation and maintenance of internal reliability compliance programs? G. Is the activity necessary or appropriate for the development and provision of tools and services that are useful for the provision of adequate reliability, because they relate specifically to compliance with existing Reliability Standards and they proactively help avert Reliability Standard violations and Bulk Power System disturbances? Is the activity necessary or appropriate for conducting and disseminating periodic assessments of the reliability of the Bulk Power System or monitoring the reliability of the Bulk Power System? A. Is the activity necessary or appropriate for the preparation or dissemination of long-term, seasonal, and special assessments of the reliability and adequacy of the Bulk Power System? B. Is the activity necessary or appropriate for measuring reliability performance past, present and future; publishing or disseminating the results of such measurements; analyzing the results of such measurements; identifying and analyzing risks to reliability of the Bulk Power System based on such measurements; and/or identifying approaches to mitigating or eliminating such risks? C. Is the activity necessary or appropriate for investigating, analyzing, evaluating, and disseminating information concerning, the causes of major events and off-normal occurrences, and/or providing coordination assistance, technical expertise and other assistance to users, owners, and operators of the Bulk Power System in connection with Bulk Power System major events and off-normal occurrences, but not real-time operational control of the Bulk Power System? D. Is the activity necessary or appropriate for awareness of circumstances on the Bulk Power System and to contribute to understanding risks to reliability? E. Is the activity necessary or appropriate for gathering, analyzing and sharing with and among industry and government participants, information regarding the physical or cyber security of the Bulk Power System? F. Is the activity necessary or appropriate for the development and dissemination of Advisories/Recommendations/Essential Actions regarding lessons learned and potential reliability risks to users, owners, and operators of the Bulk Power System? G. Is the activity necessary or appropriate for data collection and analysis of information regarding Bulk Power System reliability matters mandated by the Commission? Is the activity one that was required or directed by a Commission order issued pursuant to FPA 215? Justification of an activity as a FPA 215 activity based on this category must reference the particular Commission order and directive. V. Is the activity one that is required or specified by, or carries out, the provisions of NERC s ROP that have been approved by the Commission as Electric Reliability Organization Rules (defined in 18 C.F.R. 39.1) pursuant to FPA 215(f)? VI. Is the activity necessary or appropriate for the supervision and oversight of Regional Entities in the performance of their delegated responsibilities in accordance with FPA 215, 18 C.F.R. Part 39, the Commission-approved delegation agreement between NERC and the Regional Entity, the NERC ROP, and applicable provisions of Commission orders? 135

139 VII. VIII. IX. Exhibit B Application of NERC Section 215 Criteria Is the activity necessary or appropriate to maintain NERC s certification as the Electric Reliability Organization? This Criterion includes conducting periodic assessments of NERC s and the Regional Entities performance as the Electric Reliability Organization as required by 18 C.F.R. 39.3(c). Does the activity respond to or is it necessary or appropriate for audits of NERC and the Regional Entities conducted by the Commission? Is the activity necessary or appropriate for NERC and Regional Entity committees, subcommittees and working groups engaged in activities encompassed by one or more of the other criteria? X. Is the activity necessary or appropriate for the analysis and evaluation of activities encompassed by one or more of the other criteria for the purpose of identifying means of performing the activities more effectively and efficiently? XI. Is the activity a governance or administrative/overhead function, activity or service necessary or appropriate for the activities encompassed by the other criteria and, in general, necessary and appropriate to operate a functioning organization? (Should NERC perform any non-fpa 215 activities, the costs of governance and administrative/overhead functions must be appropriately allocated.) NERC s current governance and administrative/overhead functions are carried out in the following program areas: A. Technical Committees and Members Forum Programs B. General and administrative (includes, but is not limited to, executive, board of trustees, communications, government affairs, and facilities and related services). C. Legal and Regulatory. D. Information Technology E. Human Resources F. Accounting and Finance. The following matters are excluded from the scope of FPA 215 activities. While a list of non-fpa 215 activities would be infinite, the following excluded matters are listed here because they are expressly referred to in FPA 215, the Commission s ERO regulations and/or a Commission order issued pursuant to FPA 215: A. Developing or enforcing requirements to enlarge Bulk Power System facilities, or to construct new transmission capacity or generation capacity, or requirements for adequacy or safety of electric facilities or services. B. Activities entailing Real-time operational control of the Bulk Power System. C. Activities pertaining to facilities used in the local distribution of electricity. 136

140 Exhibit C Contractor and Consulting Costs Consultants & Contracts 2017 Budget 2018 Budget Increase (Decrease) Compliance Assurance Reliability Assurance Initiative $ 50,000 $ 50,000 $ - Total $ 50,000 $ 50,000 $ - Reliability Assessment and System Analysis Reliability Effects of GMD $ 100,000 $ 100,000 $ - Reliability Consulting Support 425, ,000 - Total $ 525,000 $ 525,000 $ - Performance Analysis GADS/TADS/DADS $ 528,082 $ 572,030 $ 43,948 Total $ 528,082 $ 572,030 $ 43,948 Situation Awareness Reliability Tools $ 619,150 $ 600,595 $ (18,555) Secure Alerting System 96,000 96,000 - SAFNR - Phase II 505, ,900 18,200 Communication Network 75,000 75,000 - Total $ 1,295,850 $ 1,295,495 $ (355) E-ISAC Security Consulting $ 33,000 $ 33,000 $ - GridEx Support 350, ,000 (208,000) Program Level Capabilities 353, , ,000 Software and Services 113, ,200 (8,085) Events and Outreach 50,550 50,000 (550) CRISP 5,888,594 6,291, ,000 Total $ 6,788,429 $ 7,346,794 $ 558,365 Personnel Certification System Operator Testing Expenses $ 62,000 $ 58,500 $ (3,500) System Operator Examination Development 70,000 50,000 (20,000) Job Task Analysis - 42,000 42,000 SOCCED Database Maintenance/License 37,800 25,200 (12,600) SOCCED Database Improvements 50,000 75,000 25,000 Total $ 219,800 $ 250,700 $ 30,900 Training and Education Continuing Education Program $ 145,800 $ 133,200 $ (12,600) ERO Enterprise Learning Portal 55, ,150 48,150 ERO Enterprise and Industry Course Development 125,000 76,850 (48,150) NERC Staff Technical Training 35,000 35,000 - Total $ 360,800 $ 348,200 $ (12,600) General and Administrative Communications Support $ 15,000 $ 20,000 $ 5,000 ERO Effectiveness Survey - 80,000 80,000 Total $ 15,000 $ 100,000 $ 85,000 Information Technology ERO Application New Functionality $ 100,000 $ - $ (100,000) ERO Application Enhancements 387, ,989 38,727 ERO Application Support 774, ,977 77,452 ERO Data Analytics 200,000 - (200,000) Ongoing Operations 851, ,000 (5,000) Total $ 2,312,787 $ 2,123,966 $ (188,821) Human Resources Executive Training and Development $ 100,000 $ 150,000 $ 50,000 Staff Training and Development 250, ,000 - Compensation Consulting 100, ,000 75,000 Employee, Industry and Board Surveys, Succession Planning 50,000 40,000 (10,000) HR Consulting Services 75,000 25,000 (50,000) Total $ 575,000 $ 640,000 $ 65,000 Finance and Accounting Internal Controls and Outside Auditor Consulting Support $ 300,000 $ 220,000 $ (80,000) Finance and Accounting Support 157, ,000 50,000 Finance and Accounting $ 457,000 $ 427,000 $ (30,000) Total Consultants & Contracts $ 13,127,749 $ 13,679,185 $ 551,

141 Exhibit D Capital Financing The company initiated a capital financing program in January 2014 as a funding source for major software application development projects that primarily benefit the ERO Enterprise. The total size of the original nonrevolving credit facility was $7.5M and was used to finance a portion of NERC s capital expenditures (including IT hardware and software application development costs) made through December A similar non-revolving credit facility was closed in November 2016, totaling $5.0 million, and is available to finance certain capital expenditures made from January 2017 to December The interest rate for both credit facilities is floating and equal to LIBOR plus 275 basis points. Authorized annual borrowings under the facilities are limited to the amount approved by the NERC Board of Trustees and FERC in each year s business plan. Borrowings under the credit facilities are amortized over a three year period, and can be prepaid without penalty. As further discussed in the Introduction and Executive Summary and set forth in the table below, NERC has a 2018 proposed capital budget of approximately $3.7M, of which it is proposing to finance $2.1M. NERC Capital Budget Budget 2017 Budget 2018 Variance 2018 Budget v 2017 Budget Variance % ERO Application Development $ 700,000 $ 2,100,000 $ 1,400, % E-ISAC Portal Improvement 1,000,000 - (1,000,000) % Document Management Program 335,000 - (335,000) % Hardware (storage, servers) 991, ,000 (186,000) -18.8% Other Equipment 885, ,000 (515,000) -58.2% Disaster Recovery 150, ,000 (50,000) -33.3% NERC Software Licenses 311, ,000 (10,000) % Total $ 4,372,000 $ 3,676,000 $ (696,000) -15.9% The tables set forth below show the projected year-end outstanding debt and the future annual payments for debt service. In the 2018 budget, NERC plans to finance $2.1M for ERO application development projects. The debt service projection assumes an average interest rate of 4.0% over the term of the financing, which is a slight increase over previous year budgets. Year-End Outstanding Debt Balance Prior Years Actual 2017 Projected 2018 Budget 2019 Projected 2019 Projected Prior Years ( Borrowing) $ 1,864,374 $ 1,111,961 $ 394,688 $ - $ Projection - 1,450, , , Budgeted - - 2,100,000 1,400, , Projected ,400,000 1,600, Projected ,450,000 Total Outstanding Balance $ 1,864,374 $ 2,561,961 $ 3,461,354 $ 4,283,333 $ 4,750,

142 Exhibit D Capital Financing Future Annual Payments for Debt Service 2017 Projected 2018 Budget 2019 Projected 2019 Projected Prior Years - Principal $ 752,413 $ 717,274 $ 394,688 $ Projection - 483, , , Budgeted , , Projected , Projected Interest Expense 64,544 88, , ,111 Total Principal and Interest Costs $ - $ 816,956 $ 1,289,320 $ 1,697,194 $ 2,128,

143 Exhibit E Working Capital and Operating Reserve Amounts Exhibit E Working Capital and Operating Reserve Amounts In September 2015, the Commission approved NERC s proposed amendments to its Working Capital and Operating Reserve Policy, which had been approved by the NERC Board. A number of changes were made to the policy, including: Clarifying the definition of working capital to represent funding needed for cash flow purposes due to the timing of the receipt of funds and the payment of expenses. Creating four separate categories of operating reserves: 1. A new subcategory of reserves entitled Future Obligation Reserve for funds that are being held to satisfy obligations that will be settled in a future year. Examples include leases, certain contracts, and credit agreements. These reserves were previously included within the definition of working capital, but are more accurately classified as a form of operating reserve. 2. Continuation of a separate category of reserves for the Operator Certification Program called the System Operator Certification Reserve. 3. Elimination of the Known and Unforeseen Contingency categories of operating reserves and creating a single category of contingency reserves called the Operating Contingency Reserve. 4. Creation of a separate category of reserves for CRISP called the CRISP Reserve. Working Capital Based on its 2017 cash flow projection and taking into account the historic manner in which NERC s assessments have been billed and paid, NERC does not anticipate needing access to working capital in 2018 to meet monthly cash flow needs. While individual reserve categories are increasing and decreasing based on operating needs and uses, the budget in total does not reflect additional net funding for reserves. In the unlikely event NERC experiences a temporary cash flow shortage, it has the ability to either request authorization from the Finance and Audit Committee and Board of Trustees to temporarily access operating contingency reserve funds, or draw on its $4M line of credit, as long as NERC is in compliance with the covenants under its bank credit agreement. Operating Reserves Total operating reserves are budgeted to be $6.1M at December 31, 2018 among all four categories, or $5.6M excluding the $500,000 CRISP Reserve. The Future Obligation Reserve is budgeted to be $2.0M and is primarily funds held to offset future liabilities under lease agreements for the Atlanta and Washington, DC, offices. System Operator Certification Reserves are budgeted at $1.1M, and the Operating Contingency Reserve is budgeted for $2.6M. The CRISP Reserve (budgeted at $500k) is held pursuant to the terms of the Master Services Agreement between NERC and participating utilities, which calls for a separate third-party funded reserve established to fund certain contingencies in connection with CRISP. In addition to the foregoing reserves, the amended policy also provides for an Assessment Stabilization Reserve. The goal of the Assessment Stabilization Reserve is to mitigate assessment volatility and have percentage changes in annual assessments track, within a reasonable band, percentage changes in the company s total annual budget, with the total budget reflecting prudent fiscal discipline and good stewardship of resources. Assessment stabilization funds will be used when available to help stabilize assessments and mitigate year-to-year swings in assessments. Those swings primarily result from the year-to-year variations in collections of penalty funds to be applied to offset assessments, but could also result from other factors like surplus funds available from a prior period, the need to replenish the Operating Contingency Reserve, or significant but relatively short-term operating or capital spending needs. Subject to Board and Commission approval, NERC proposes (1) to place the $500,000 of Penalties collected in the 12 months ended June 30, 2017, into the Assessment Stabilization Reserve, resulting 140

144 Exhibit E Working Capital and Operating Reserve Amounts in a balance on January 1, 2018 of approximately $2.2M, funded entirely by penalties, and (2) not to use any funds included in the balance at January 1, 2018 to offset 2018 U.S. assessments. NERC s proposals will result in a balance remaining in the Assessment Stabilization Reserve of $2,171,000 at December 31, 2018 (assuming that after June 30, 2017, no additional Penalties are received and placed into the Assessment Stabilization Reserve). This balance will be available to be used, with Board and Commission approval, to mitigate annual assessment increases in future years. 141

145 Exhibit F E-ISAC Long-Term Strategy 2018 NERC Business Plan and Budget Addendum Long Term E-ISAC Strategy and Funding Background and Introduction Over the past several years the Electricity Information Sharing and Analysis Center (E-ISAC) has focused on improving its technical and analytical capabilities with a goal of becoming the electricity industry s leading, trusted source for analysis and sharing of security information. Significant support from the Electricity Subsector Coordinating Council (ESCC), the ESCC Members Executive Committee (MEC), the U.S. Department of Energy, and other stakeholders have helped the E-ISAC be responsive to the industry s needs in order to provide unique insights, leadership, and coordination for security matters. In the fourth quarter of 2014 and with broad industry support, the E-ISAC assumed management responsibility for the Cybersecurity Risk Information Sharing Program (CRISP), a public-private partnership that facilitates the automatic sharing of cyber threat information. The CRISP program also develops situation awareness tools that enhance the electricity sector s ability to identify, prioritize, and coordinate the protection of its critical infrastructure. CRISP provides critical infrastructure owners and operators the capability to voluntarily share cyber threat data, analyze this data, and receive machine-to-machine mitigation measures. Information-sharing devices installed on participants networks send encrypted data to a CRISP analysis center operated by the Pacific Northwest National Laboratory (PNNL), which analyzes the data it receives and sends alerts and mitigation measures back to CRISP participants and the E-ISAC through secure communication channels. Industry participation has increased significantly since CRISP became fully operational in 2015, and today the program supports the major utilities that serve about 75% of the metered electricity customers in the United States. At the request of the NERC Board of Trustees and under the guidance of the ESCC and MEC, executive leadership of the E-ISAC developed a long-term strategic plan, a copy of which is attached hereto. The E-ISAC Long Term Strategic Plan was approved by the MEC on April 24, 2017 and accepted by the NERC Board of Trustees on May 11, The long-term strategic plan is to transform the E-ISAC into a world-class intelligence collecting and analytical capability for the electricity industry. In furtherance of this vision, the E-ISAC is planning for a continuous improvement and evolution that reflects the changing threat landscape, changing technologies and business processes inside the industry, and changing customer expectations for a highly reliable and secure electricity infrastructure that is increasingly more integrated with less secure infrastructures, such as the public Internet. This strategy recognizes the growing threats to the grid from human and cyber actors, and highlights the need for a more robust security information sharing and analysis capability within NERC, while also reflecting an approach based upon sound fiscal planning. To achieve this goal, the E-ISAC is focused on increasing its capability to collect security intelligence; conduct sophisticated and specialized analysis; acquire additional data storage, management, and sharing technologies; and increase its access to classified networks and facilities. The following paragraphs discuss the additional future resource requirements necessary to support this long-term strategy, including the specific resource additions being proposed for Resource requirements for subsequent years will be subject to ongoing refinement, review and approval as part of NERC s annual business plan and budget process. Senior management will continue to work closely with the MEC to ensure that the capabilities and services provided are aligned with and support the strategic plan. Periodic progress reports will also be provided to the NERC Board of Trustees and industry stakeholders. 142

146 Increased Capabilities and Services Exhibit F E-ISAC Long-Term Strategy Improved Intelligence Collection, Analysis, and Information Sharing The E-ISAC continues to improve the collection, analysis, and sharing of unclassified but sensitive information. New collection capabilities coming online in 2017, such as the E-ISAC s Cyber Automated Information Sharing System (CAISS) project and continued expansion of the Cybersecurity Risk Information Sharing Program (CRISP), will provide additional technical intelligence. As these technologies mature they will require increased staffing to screen, analyze, summarize, disseminate and maintain information shared with industry participants. In 2018, the E-ISAC plans to implement additional monitoring (either directly or through the services of third parties) of public and private networks for new technical threats; and increase the ability to monitor social media and other open sources for human threats. Beyond 2018 the E-ISAC plans to launch a pilot project to begin collecting data from sensors in Operational Technology (OT) networks that will search for destructive threats. 1 These additional intelligence and information gathering capabilities will also require increased staffing to analyze and share security information derived from them. Improved Analytical Capabilities Sophisticated threat analysis requires technical analysts and tools with specializations in fields such as industrial control system security, end-point (host) security, network security, cloud security, and penetration testing. In 2018, the E-ISAC plans to add data visualization capabilities to its portal technology that will assist members in understanding what threats are targeting them versus the broad sector; provide a malware reverse engineering capability; and be able to conduct remote testing of security perimeters and devices. Measuring and understanding the impact of security controls and other actions taken to mitigate threats will be a new capability of the E-ISAC in In order to determine the effectiveness of NERC s reliability standards and other investments made by the electricity industry, the E-ISAC plans to deploy new technologies designed to measure the effectiveness of these security initiatives. Beyond 2018, other analytical initiatives planned include adding big data analytics 2 to the CRISP and CAISS programs; the ability to verify device security through the use of passive attack tools; and developing customized control system security analysis tools. On the new portal platform, the E-ISAC plans to provide customized security monitoring and plug-in security modules for members that will allow them to define their own views of the security of their systems. This ability to view a member s own data and compare it to anonymized data from other members will be unique to the E-ISAC and the electricity industry. Improved Industry Engagement A major focus for the E-ISAC over the past two years has been improving our engagement with the electricity industry. The new portal platform being launched in 2017 is a core capability that will serve as a foundation for improved information sharing and new types of membership engagement. In 2018, the E-ISAC plans to launch a robust reputation monitoring and warning capability for the members similar to the Domain Name System (DNS) monitoring project that was piloted in 2016; build and maintain a protected database of members technical data including assigned Internet Protocol ranges, domain names, cloud service 1 OT networks are typically separate from enterprise information technology networks and are used for controlling or monitoring machinery, relays, breakers, and other operational or control systems. 2 Big data analytics refers to the ability to analyze very large repositories of data, looking for correlations of information that otherwise would appear to be unrelated. 143

147 Exhibit F E-ISAC Long-Term Strategy providers, key applications, contact information and other critical member-specific data; provide on-site physical security guidance and incident analysis; and create a cyber range 3 for members to support GridEx and other simulated training environments. In future years, other engagement initiatives will include providing increased support to smaller industry members; creating cyber teams that can assist with on-site cyber security analytics; producing top quality training videos or online applications for various security subjects; and providing E-ISAC liaisons to other industry sector watch centers for better cross-sector collaboration. Measuring Success Measuring impact or direct changes to the security of the grid based on these new capabilities is difficult. The E- ISAC plans to provide quarterly updates to both the MEC and the NERC Board of Trustees highlighting the progress made on acquiring new personnel, deployment of new tools and technologies, and analysis of the impact on the industry as best as can be determined. As data is collected with the new tools, it will become possible to measure with increasing accuracy the direct impact on grid security. This analysis will assist the E-ISAC, the MEC, the NERC Board of Trustees, and other stakeholders in determining the impact of these improvements and identifying where improvements can be made. Additional Resource Requirements Personnel The E-ISAC is currently staffed with 22 full-time employees as of May 2017 and plans to hire an additional three employees by the end of the year, for a total of 25 employees. To meet the staffing levels recommended to fully execute the long-term strategic plan, the E-ISAC anticipates an additional 27 employees are needed. Management recommends these additional employees be phased-in over a five-year period in order to better facilitate the hiring, acquisition and integration of personnel, as well as to mitigate annual budget and assessment increases. In addition to these E-ISAC staff additions, additional corporate support resources will also be required, primarily related to information technology, legal, and finance. Projected resource additions for each year will also be subject to a review of the E-ISAC performance and progress in execution of the long-term strategy, as well as review and approval as part of NERC s annual business plan and budget process In 2018 the E-ISAC proposes to hire an additional six employees at an estimated incremental cost of $1.08 million. These six new positions include one watch officer, two cyber analysts, one CRISP analyst, one physical analyst, and an administrative support position. The performance of these additional employees and their impact on increasing the security of the grid will contribute to decisions for future levels of staff increases. With the addition of these six new positions, the E-ISAC s 2018 organizational chart is as follows: 3 A cyber range is a simulated training environment for system administrators and network defenders that allows them to experiment with different types of defensive tools against different types of attackers. This approach is widely used in the military and with defense contractors, and will be very powerful addition to the Electricity industry s set of cyber defense tools. 144

148 Exhibit F E-ISAC Long-Term Strategy Technology As more data is collected, the E-ISAC will need to acquire additional data storage, management, and sharing technologies. These technologies must be as secure as possible, given that the risk of a targeted data breach will increase as the E-ISAC improves its capability to give early warning to industry about threats and vulnerabilities discovered via data analysis. The estimated annual incremental cost of new technologies each year over the next five years is estimated to range between $250k to 500k per year. Specific technologies needed to support the long-term plan in 2018 include event visualization via the new platform, predictive analysis based on artificial intelligence, real-time threat feeds to members, a customized platform experience for each user, and federated information sharing. Other technologies to be added after 2018 include increased data storage capability with big data analytics for CRISP; tools for monitoring open source intelligence; malware reverse engineering tools; metrics development tools; passive security testing capability; reputation monitoring services; and increased network capacity between the E-ISAC and various Department of Energy laboratories. Facility Improvements As the size of the E-ISAC grows, ongoing facility improvements will made each year over the next five years to accommodate these needs. Building on improvements made in 2017 there will be additional costs for upgrades to the Watch Operations Center, the Cyber Analysis Center, and to the displays, monitors, workstations, and other fixed assets throughout the E-ISAC. 145

149 Exhibit F E-ISAC Long-Term Strategy Total Projected Costs The chart below shows the cost projections for personnel, technology and facility improvements over the next five years. These costs are the incremental costs expected in each year, not the accumulated costs over time. E-ISAC Strategic Plan Cost Projections by Year Other Staffing, E-ISAC Technology Support, and Total Staffing and Tools Facilities* Per Year 2018 $ 1,080,000 $ 500,000 $ 225,000 $ 1,805, ,080, , ,000 1,855, , , ,000 1,325, , , ,000 1,505, , , ,000 1,705,000 Total $ 4,860,000 $ 1,750,000 $ 1,585,000 $ 8,195,000 * This category includes administrative staff support outside the E-ISAC department, professional services costs, and costs related to facilities upgrades. Funding Alternatives The majority of NERC s operations have traditionally been funded through assessments, which are allocated to load serving entities on a net energy for load basis. There are several exceptions to this general funding approach. NERC s operator certification and training program is funded through testing fees, and the cost of certain conferences, including NERC s Human Performance and Grid Security conferences, have been offset by registration fees. In addition, when CRISP was established, an agreement was reached with the CRISP participants that the costs incurred by NERC under its subcontract with PNNL should be entirely funded by CRISP participants, since these costs directly benefit the CRISP participants. However, since CRISP data is also used to provide threat information to registered users of the E-ISAC, it was recognized and agreed that funding a portion of the program through assessments was also appropriate. Since the program was new and E-ISAC resources would be utilized to analyze, anonymize and share CRISP data through the E-ISAC portal for the benefit of all users of the portal and load serving entities generally, a decision was made to share the funding of NERC s internal costs to support CRISP equally between assessments and participants in the program. For 2018, management is recommending that the proposed resource additions not related to the CRISP program be funded through assessments. The additional resources related to CRISP analytics will be included in the CRISP program budget and recommended for approval by those participants. As the E-ISAC resource requirements and associated funding needs continue to grow, management believes there is merit in continuing to explore alternative funding mechanisms, including the potential for public and private sector support, to fund future information technology and infrastructure needs. The table below shows a "base" budget from 2018 through 2022, assuming growth of 3% and no significant staffing, technology, or facilities additions. For additional information on this base budget, see the E-ISAC section 146

150 Exhibit F E-ISAC Long-Term Strategy in the budget narrative. The Added Costs are based on the previous table showing the incremental costs per year related to this strategic plan. These costs are both accumulated (i.e. staffing additions) and incremental (i.e. one time technology tools or facilities expenditures) as necessary such that the 2022 Strategic Plan Budget amount represents the total projected cost for that year to accommodate both the base operations and additional strategic plan costs discussed herein. E-ISAC Total Budget including Strategic Plan E-ISAC Strategic Plan Base Budget* Added Costs Budget 2018 $ 18,996,833 $ 1,805,000 $ 20,801, ,566,738 3,235,000 22,801, ,153,740 4,385,000 24,538, ,758,352 5,715,000 26,473, ,381,103 7,245,000 28,626,103 Impact on 2018 NERC Budget and Assessments All of these costs will be incremental to the proposed base-case NERC budget, and most of them will be incremental to the assessment increase. However, one of the additional analysts is allocated to CRISP and will be included in the 2018 budget for consideration by those members. Therefore, as the table below reflects, the impact on the NERC budget is $1.8M and the impact on assessments is $1.7M, with the remaining $90,000 related to the CRISP analyst position included with the CRISP budget for 2018 and funded accordingly. The table below shows the impact of this strategy on the current NERC base-case budget, reflecting an increase to the budget of 5.1% (previously 2.5%) and an increase in NERC assessments of 6.0% (previously 3.3%). This NERC assessment projection does not include any releases from the Assessment Stabilization Reserve which may offset the 2018 assessment billings. E-ISAC 2018 Budget and Assessment Impact Change $ % NERC Budget (current base case) $ 69,602,175 $ 71,376,999 $ 1,774, % 2018 E-ISAC strategic additions - 1,805, NERC Budget - adjusted $ 69,602,175 $ 73,181,999 $ 3,579, % NERC Assessments (current base case) $ 59,856,314 $ 61,804,211 $ 1,947, % 2018 E-ISAC strategic additions - 1,715, NERC Assessments - adjusted $ 59,856,314 $ 63,519,211 $ 3,662, % 147

151 Attachment E-ISAC Long Term Strategic Plan Executive Summary The Electricity Information Sharing and Analysis Center (E-ISAC), operated by the North American Electric Reliability Corporation (NERC), executed a significant improvement initiative over the past two years based on findings and recommendations developed by the Electricity Subsector Coordinating Council (ESCC) in Looking forward, the electricity industry would like the E-ISAC to become an indispensable resource for security information sharing and analysis, and to be the centerpiece for building a highly engaged community of security professionals. To carry forth this vision, the E-ISAC must undergo continuous improvement and evolution that reflects the changing threat landscape, changing technologies and business processes inside the industry, and changing customer expectations for a highly reliable and secure electricity infrastructure that is increasingly more integrated with insecure infrastructures such as the public Internet. This will require additional resources for people, technology, and facilities above what has been budgeted in previous years. This strategic plan builds on the ESCC s earlier recommendations and discusses improvements needed in 2017 to address current threats, a look at the mid-term range of to address emerging threats, and what the E- ISAC might look like beyond 2023 if the forecasted issues continue to develop. The plan was developed with guidance from the ESCC and from NERC leadership. It recognizes the need for sound fiscal planning, recognizes the growing threats to the grid from human and cyber actors, and highlights the need for a more robust security information sharing and analysis capability within NERC. At a recent planning session with C-level executives, one utility CEO said he wanted to transform the EISAC into an intelligence collecting and analytical capability that industry literally cannot do without, which resonated strongly among the other executives. To achieve this goal we must get the E-ISAC to a maturity level where industry completely trusts it to gather, hold, analyze, and distribute highly sensitive security information. Specific financial projections, technology requirements, staffing, and facility improvements are being developed and will be incorporated in the NERC strategic plan and the NERC business plan and budget. Background The Electricity Information Sharing and Analysis Center (E-ISAC) is operated by the North American Electric Reliability Corporation (NERC). 53 It was established by NERC at the request of the U.S. Department of Energy in 1999 to serve as a focal point for voluntary information sharing within the electricity subsector. By 2006, the ISAC was widely used in the subsector for collecting, analyzing, and distributing voluntarily-shared security information and was a key component of NERC s overall electric reliability mission. NERC s Board of Trustees oversees the budget and activities of the E-ISAC in the same manner as other NERC divisions. NERC assumed the role of the Electric Reliability Organization (ERO) in 2006 and began a multi-year effort to develop enforceable reliability and security standards for the electricity subsector. As the standards were completed and compliance monitoring began, the ISAC remained the place where security incidents were reported, but the voluntary nature of reporting from electricity entities shifted towards mandatory reporting 53 Initially called the Electricity Sector Information Sharing and Analysis Center (ES-ISAC), the name was changed in September 2015 to the Electricity Information Sharing and Analysis Center (E-ISAC) as part of a rebranding and role-clarification initiative. 148

152 Exhibit F E-ISAC Long-Term Strategy from entities required to be compliant with NERC s Critical Infrastructure Protection (CIP) standards. By 2014, voluntary sharing with the E-ISAC had greatly diminished in favor of mandatory reporting, but the desire for voluntary sharing within the subsector remained strong. The following year a perceived problem of internal NERC cross-sharing of security information was addressed when NERC implemented the employee code of conduct that bars voluntarily shared security information from being forwarded to NERC s compliance and enforcement teams. Also in 2015 the E-ISAC finished a separation project that includes physical and electronic barriers to protect the information voluntarily shared by industry members. In late 2014, the Electricity Subsector Coordinating Council (ESCC) initiated a strategic review of the E-ISAC. In June 2015, the ESCC published its key findings and recommendations, which fell into four major areas of improvement for the E-ISAC: 1. Strengthen the governance structure and processes to increase effectiveness and responsiveness 2. Improve the quality and value of the products by identifying member needs and expectations 3. Advance the analysis capabilities by continuing to upgrade operational and staff capabilities 4. Advance the information collection capabilities through enhanced member engagement, better tools or sensors, and an improved portal A C-level advisory team from the ESCC (the Member Executive Committee, or MEC) was established in 2015 to help enable the implementation of the ESCC s recommendations, which included a new vision for the EISAC to become the electricity industry s leading, trusted source for analysis and sharing of security information. As of April 2017, much progress has been made toward realizing this vision and now we look forward to the next five years and beyond while asking the question, how do we transform the E-ISAC into an intelligence collecting and analytical capability industry cannot do without? To begin this process, the following section looks back at known threats and ahead at the anticipated evolving nature of future threats targeting the electricity industry. The Changing Threat Landscape A study conducted for the ESCC by the Chertoff Group in found that a range of threats target the electric power grid. These threats can be approximately related to each other by using a likelihood versus consequence plotting. We feel that the E-ISAC s sweet spot is roughly along the 45-degree line as depicted in the graphic below. 54 Addressing Dynamic Threats to the Electric Power Grid Through Resilience Dynamic-Threats.compressed.pdf 149

153 Exhibit F E-ISAC Long-Term Strategy Industry by itself cannot protect the grid from all hazards, and likewise neither can the government. A strong partnership between industry and government for security is required, and in fact has been in place for many years. At the center of this partnership is the ESCC, which serves as a bridge between the public and private sectors for strategic security policy coordination and to develop unity of messaging during a crisis. In addition, timely and actionable information sharing, collaboration, and analysis are the cornerstones of good security practices within the electricity industry. The E-ISAC s role is to facilitate voluntary sharing and collaboration, and to provide unique insights into emerging security issues that are affecting the sector. In January 2017 the E-ISAC and the MEC met in person to discuss the future of the E-ISAC relative to changing threats, changing industry dynamics, and a changing environment. While physical threats resulting in theft, vandalism, disruption, or destruction will always be present, the group recognized that cyber threats and other types of threats are evolving and will require adaptive change throughout industry and especially with respect to the E-ISAC. The group agreed that future threats industry needed to monitor and mitigate included: Near-term (0-2 years) Nation state threats, advanced persistent threats, the Internet of Things (IoT), Distributed Denial of Service (DDoS) attacks, and ransomware Data breaches and intellectual property theft Insiders, physical damage, coordinated attacks, and third-party risks Mid-term (3-5 years) Increased reliance on gas generation Distribution system vulnerabilities via networked control systems Growth of demand response technologies with low security Distributed energy resources Reliability of communications networks 150

154 Exhibit F E-ISAC Long-Term Strategy Long-term (5-10 years) Higher replacement rate of components and systems Increased cost of operations due to higher security costs Ability to run manually might be lost Computers attacking computers The remainder of this plan discusses improvements needed in 2017 to address current threats, a look at the midterm range of to address emerging threats, and what the E-ISAC might look like beyond 2023 if the forecasted issues continue to develop. The Need for a Strategic Plan Given that quite a bit of work was accomplished over the past two years to improve the E-ISAC, it is reasonable to ask why a long-term strategic plan is needed. Looking externally, there are three primary drivers: 1. Security threats continue to evolve and become more dangerous a. Ukraine, IoT, and ransomware attacks are indicators b. Geopolitical tensions and changing societal trends make North America a target 2. Customer expectations for highly reliable energy continue to increase a. Electricity entities need to be more agile and responsive to real-time risks b. Rapid technology changes also increase the risk landscape 3. More robust understanding and measurement of grid resiliency and security a. Need new tools for collecting and analyzing grid security metrics data Since the publication of the ESCC s strategic review in 2015, the E-ISAC has solidified vision, mission, values and goals statements as shown in the graphic below. The three goals columns represent parts of a rising spiral of membership engagements: bringing in more information improves the analytical process, which in turn drives more engagement, which then brings in more information, which improves analytics, and so forth. 151

155 Exhibit F E-ISAC Long-Term Strategy This process takes the E-ISAC to new levels as it gets better at information collection, analysis, and dissemination and represents the core capabilities of the E-ISAC. The MEC and the E-ISAC developed a related strategy for the improvement of the E-ISAC s products and services that builds upon the pillars shown in the graphic above, and is working on a technology roadmap in partnership with NERC s Information Technology team that also follows this method. Both of these more tactical plans support the goals and objectives of the E-ISAC s long-term strategic plan. Transforming the E-ISAC: 2017 and Beyond In the coming years, NERC should build on the foundation of the 2015 ESCC recommendations, and position the E-ISAC to provide more robust security information for better understanding of security weaknesses and strengths across the ERO. By addressing the three primary drivers outlined above, NERC can transform the E-ISAC into a world-class intelligence collecting and analytical capability for the electricity industry. To accomplish this, the E-ISAC must achieve a maturity level where industry completely trusts it to gather, hold, analyze, and distribute highly sensitive security information, with no fear that information voluntarily submitted to the E-ISAC would ever be used for a compliance enforcement action or investigation. As we strengthen the foundation built over the past two years, the E-ISAC should undertake a comprehensive multi-year transformation to build capabilities that include trusted, secure, multidirectional networks and a movement from a hub/spoke model to a very active multi-level engagement. The E-ISAC strives to be the industry s most credible source for actionable, big picture information. This roadmap is illustrated in the graphic below. 152

156 Exhibit F E-ISAC Long-Term Strategy 2015 and 2016 were foundation-building years, set in motion by the ESCC strategic review and the publication of the findings and recommendations. In 2015, NERC implemented an employee code of conduct, completed a physical and logical separation of the E-ISAC from other parts of NERC, hired strategic leadership and key industry experts, and rebuilt the organization with new internal functional groups. Also that year, the name was changed from the ES-ISAC to the E-ISAC and new logos, color schemes, and branding were launched. In 2016, the old web portal was upgraded with the intention of setting in motion a completely new platform capability that will launch later in Over the past two years, membership engagement and information sharing grew rapidly, new products and services were launched, and the third Grid Security Exercise (GridEx III) was successfully administered by the E-ISAC. The impact of these initial changes on the E-ISAC s capability to respond to real-world incidents was validated by the Ukraine grid attacks in December 2015, denial of service attacks from Internet of Things (IoT) devices in October 2016, and the second Ukraine event along with the Grizzly Steppe incident at the end of December As was pointed out frequently in the past two years, the IS and the A in ISAC define the two primary strategic themes that must be in place for the organization to be successful. In 2017, the E-ISAC is deploying new information sharing and analysis tools such as the Cyber Automated Information Sharing System (CAISS) and an Event Visualization Tool (EVT) to increase the speed and ease of sharing cyber threat information. While the Cybersecurity Risk Information Sharing Program (CRISP) has enhanced visibility and understanding of cyber threats for the electricity industry, processing classified information takes time. As information comes in from CRISP sensors and goes to the Pacific Northwest National Laboratory, the E-ISAC will leverage a new unclassified data storage and analytics capability inside the E-ISAC so that more actionable information can be sent to industry on a timelier basis. Later this year we anticipate that alerts and technical information will flow securely between CAISS and CRISP in our efforts to expand our data collection beyond the current participant pool and to achieve a more comprehensive picture of industry threats than we have today. The major technical effort in 2017 is a planned replacement of the current web portal with a new platform that will enable automatic information sharing, the creation of private discussion groups, data visualization, and many other features that the E-ISAC s members requested. To support the new tools and the needs of the sector, 153

157 Exhibit F E-ISAC Long-Term Strategy additional analysts will be hired in In addition, new partnerships are envisioned with organizations like the Computer Emergency Response Team Coordination Center (CERT/CC), and at the end of 2017, the E-ISAC will host the GridEx IV. In mid-april 2017, the internal structure of the E-ISAC was modified to align the staff to better serve the industry. There are now two major groups one focused on operations and analysis and the other on programs and member engagement. Some minor facility improvements are also planned for Looking forward, the next five years ( ) will focus on transforming the E-ISAC into a world-class intelligence collecting and analytical capability for the electricity industry. To achieve this goal, the E-ISAC should increase its capability to collect security intelligence; increase the number of specialized analysts; acquire additional data storage, management, and sharing technologies; and increase the E-ISAC s access to classified networks and facilities. New Intelligence Collection To Support Better Unclassified Information Sharing Some new collection capabilities coming online in 2017 such as CAISS and the Department of Energy s CYOTE project will bring additional intelligence, but the E-ISAC should also consider more active monitoring of public and private networks for new threats, perhaps collecting data from sensors in Operational Technology (OT) networks, and increasing the ability to monitor social media and other open sources. Some of that new collection could be done by others as a service that the E-ISAC would pay for. Access to Classified Networks and Facilities To Improve Sharing of Highly Sensitive Information While the majority of the E-ISAC s staff hold US government security clearances, the facility inside of NERC operates at the unclassified level. This requires E-ISAC staff to travel to government facilities in order to view and analyze classified data. On the industry side, very few entities have access to classified facilities and most do not have staff with appropriate clearances. To support the strategic goal of better information sharing, both the E-ISAC and industry members should have increased access to classified data and classified information sharing networks. Relationships with government partners need to be leveraged to make valuable classified data and analysis rapidly available to asset owners and operators. More Analysts To Improve the E-ISAC s Analytical Capabilities The E-ISAC should hire technical analysts with specializations in fields such as industrial control system security, end-point (host) security, network security, cloud security, and penetration testing. Over the next three to five years an estimated ten or more analysts should be hired at a rate of two or three per year so that the annual increase of NERC s budget is minimized. Acquisition of New Technologies To Improve Industry Engagement As more data is collected, the E-ISAC should acquire additional data storage, management, and sharing technologies. These technologies must be as secure as possible, given that the risk of a targeted data breach will increase as the E-ISAC improves its capability to give early warning to industry about threats and vulnerabilities discovered via data analysis. Specific technologies needed in the next five years include event visualization via the new platform, predictive analysis based on artificial intelligence, realtime threat feeds to members, a customized platform experience for each user, and federated information sharing. Beyond 2023 security challenges will continue to expand, requiring additional resources and perhaps a different relationship across the energy industry. Due to commonality of threats across all energy companies, rapid growth of vulnerable control systems, and a convergence of lines of business within the industry, we must consider whether or not the E-ISAC should remain focused only on electricity, or if it should expand to include all energy owners/operators (electricity, gas, oil, and natural gas). 154

158 Exhibit F E-ISAC Long-Term Strategy Other items to consider beyond 2023 include the size and location of the E-ISAC facility and potential partnerships with the research community. Due to limitations of the NERC budget, some of these new capabilities would need outside funding from the government or perhaps grants from large industry companies. Other MEC Guidance Several questions were presented to the MEC membership about the long-term future of the E-ISAC. Most of the questions were answered in the discussion paragraphs above. The remaining questions not previously discussed and the MEC s summarized responses are below. Should the E-ISAC move to 24/7 operations? Not immediately but the decision should be based on changing situations and activity levels. This response is driven by the reality of the cost for the additional staff, and by the reality that very little data is submitted to the E-ISAC for analysis outside of normal business hours. But, as the E-ISAC s capabilities and data collection grow, there will likely be a point in the next 3-5 years when it might be necessary to move to round-the-clock operations. What is the E-ISAC s relationship with other ISACs? There is concern that other ISACs (the Financial Services ISAC, or FS-ISAC, is a recent example) will attempt to recruit electric utilities to pay for special analytical services in order to cover expanding costs. The consensus view of the MEC is that the E-ISAC should not discourage members from taking advantage of services offered by other ISACs, and should try to learn about those new capabilities with an eye towards developing them organically within the E-ISAC when appropriate. Services offered by other ISACs should be viewed as additional intelligence sources. Additionally, the E-ISAC should develop stronger information sharing partnerships with other ISACs and increase the level of cross-sector engagement. Should the E-ISAC have an international relationship? The E-ISAC, as part of NERC, currently has members in Canada and Mexico. The MEC recommended that the E-ISAC consider establishing formal information sharing relationships with other countries such as Japan or the United Kingdom. Because no other countries are interconnected with the North American grid beyond the US, Canada, and Mexico, any future information sharing relationship with entities in other countries would be at a very high level and must preserve the privacy of North American entities that are voluntarily sharing with the E-ISAC. Should the E-ISAC accept funding from sources beyond NERC assessments? Government funding may be necessary to cover costs of the recommended expansions of technical capabilities, staff, and facilities. MEC members cautioned about any potential attached strings that come with government grants. Beyond 2018, some member companies have expressed interest in a model like CRISP where companies can pay for additional services, or perhaps moving to a tierbased pricing model. Conclusion and Next Steps The next several years present an opportunity to transform the E-ISAC into a world-class intelligence collecting and analytical capability for the electricity industry; and an opportunity to support NERC s overall initiatives to better understand the current security posture of the North American grid. As threats, technologies, and business process change, the E-ISAC, in order to be as valuable as it can to the industry, must evolve to a maturity level where industry completely trusts it to gather, hold, analyze, and distribute highly sensitive security information. Specific financial projections, technology requirements, staffing, and facility improvements are being developed and will be incorporated in the NERC strategic plan and the NERC business plan and budget. 155

159 Exhibit F E-ISAC Long-Term Strategy Towards this transformation, for the near term (remainder of 2017 and all of 2018), the E-ISAC plans to: Hire additional analysts Increase the in-house data storage and analysis capabilities Grow the CRISP and CAISS programs Deliver a world-class information sharing platform well before GridEx IV Grow membership engagement via the new platform Increase engagement with other ISACs and information sharing partners Increase engagement with Canada and Mexico Provide higher quality grid security metrics data to support NERC s data collection initiatives 156

160 Exhibit G Compliance Monitoring and Enforcement Technology Program See below for information on the Compliance Monitoring and Enforcement Technology Program 157

161 Compliance Monitoring and Enforcement Technology Program Stan Hoptroff, Vice President and Chief Technology Officer May 18, 2017

162 CMEP Technology Program Objectives Ensure consistency in practices and data gathering by aligning common CMEP business processes across the ERO Enterprise. Improve the effectiveness of the ERO Enterprise by improving the ability to share and analyze reliability risk and compliance information. Increase efficiency of compliance work activities across the ERO Enterprise through the use of workflows and collaboration tools. 2 RELIABILITY ACCOUNTABILITY

163 CMEP Technology Program Objectives Assist the ERO Enterprise in meeting applicable requirements of generally accepted professional standards, as well as requirements established through the Rules of Procedure. Reduce total combined NERC and Regional Entity IT capital investments and maintenance cost for CMEP-related applications. Current annual licensing and maintenance fees ERO Enterprise-wide spend of $1.1M. Enable easier data entry and access to information for registered entities. 3 RELIABILITY ACCOUNTABILITY

164 CMEP Technology Program Key Activities Project communications and change management plan Workshops and requirements gathering Process and tools inventory Conceptual model for key data structures and relationships RFP and selection criteria for a new CMEP solution Business Case with cost benefit analysis SOTC Briefings (August and November Board Meetings) 4 RELIABILITY ACCOUNTABILITY

165 Preliminary Benefits Single, common portal for registered entities Visibility into compliance and reliability risks that do not exist today on an automated basis Information visible in real-time, eliminating delays and manual communications (with the right permissions) Implementation of common business processes for the CMEP program Three-percent efficiency gain for 40 percent of the ERO employees (60 hours per year) Investment break-even five to seven years $1.1M savings from retirement of legacy applications 5 RELIABILITY ACCOUNTABILITY

166 CMEP Technology Program Governance 6 RELIABILITY ACCOUNTABILITY

167 CMEP Technology Program Component Overview General Solution Approach and Alignment with Objectives The solution approach illustrated below proposes several interrelated functional components that will comprise the proposed ERO Enterprise CMEP system. The following diagram is intended to illustrate the relationship between those components. Sets CMEP Jurisdiction Entity Registration Standards/RoPs Key Inputs from various reports and analysis Planning Compliance Oversight Plan Development (ex. inherent risk assessment, internal controls review/evaluation) Field Work Compliance Monitoring Tools Reporting Reports Disposition of Non-Compliance Mitigation Quality Assurance Internal and External Oversight Applicable Professional Standards Related ERO Processes and Tools Systems contains all information to determine applicability of standards to Registered Entities Externally located, but needed for planning Single system contains all CMEP -related work documentation to support determinations 7 RELIABILITY ACCOUNTABILITY

168 8 RELIABILITY ACCOUNTABILITY